CVE-2026-71542

Deferred Deferred - Pending Action

Stored XSS in GetSimple CMS Community Edition

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: GitHub, Inc.

Description

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting (XSS) in the "Theme to Components" functionality (admin/components.php) via the title parameter. The stored title is rendered inside a double-quoted HTML attribute in the administrative interface through an output path that HTML-entity-decodes the value before printing it, without re-encoding for the attribute context. This allows persistent execution of arbitrary JavaScript in the admin panel. At time of publication, there are no publicly available patches.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-01

Generated

2026-10-02

AI Q&A

2026-10-02

EPSS Evaluated

N/A

NVD

CVE-2026-71542

EUVD

EUVD-2026-91021

Affected Vendors & Products

Vendor	Product	Version / Range
getsimple	getsimple_cms	to 3.3.22 (exc)
getsimple	getsimple_cms_ce	to 3.3.22 (exc)
getsimplecms	getsimple_cms	3.3.22
getsimplecms	getsimple_cms_ce	3.3.22

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in GetSimple CMS CE versions 3.3.22 and prior. It occurs in the Theme to Components functionality where the title parameter is improperly sanitized and rendered in an HTML attribute context. The input is HTML-entity-encoded but later decoded during output, allowing malicious JavaScript to execute in the admin panel when other users view the Components page.

Detection Guidance

Check for GetSimple CMS CE versions 3.3.22 or earlier by inspecting the version in the admin panel or files. Look for suspicious JavaScript in the Components page admin/components.php where the title parameter is rendered. Monitor network traffic for unauthorized admin actions or unusual payloads in HTTP requests.

Impact Analysis

An attacker with component editor access can inject JavaScript that executes for any authenticated user viewing the Components page. This enables session theft, CSRF-token exfiltration, and arbitrary administrative actions, leading to full compromise of the admin interface and potential site takeover.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. The persistent admin compromise may result in data breaches or unauthorized modifications, triggering compliance violations.

Mitigation Strategies

Disable the Components functionality in admin/components.php if not needed. Restrict access to the admin panel to trusted IPs. Monitor admin sessions for unusual activity. Apply input validation and output encoding at the attribute context for the title parameter. Consider upgrading to a patched version once available.

Hi! I’m here to help you understand CVE-2026-71542. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70