search

GetSimpleCMS-CE Stored XSS via components.php (CVE-2026-26351)

Author: Beatriz Fresno Naumova

Date: 24/02/2026

Vendor: GetSimpleCMS-CE

Product: GetSimpleCMS Community Edition

Version Affected: 3.3.16

Fixed Version: 3.3.22

Component: Theme to Components – components.php

CWE: CWE-79 – Improper Neutralization of Input During Web Page Generation (XSS)

Attack Vector: Remote (authenticated administrator required)

hashtag
Description

GetSimpleCMS-CE version 3.3.16 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Theme to Components functionality within components.php.

User-controlled input supplied to the slug field of a component is stored without proper output encoding. Although other fields are sanitized using safe_slash_html(), the slug parameter is written to XML and later rendered in the administrative interface without sanitization.

This results in persistent execution of arbitrary JavaScript when the affected Components page is viewed.

hashtag
Impact

Successful exploitation may allow:

  • Execution of arbitrary JavaScript in the administrative interface

  • Session hijacking

  • Unauthorized administrative actions

  • Persistent compromise of the CMS backend

hashtag
CVSS Details

CVSS v4.0 Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Base Score: 4.8 (Medium)

hashtag
Proof of Concept (PoC)

hashtag
Steps to Reproduce

  1. Install GetSimpleCMS-CE 3.3.16.

  2. Log in as an administrator.

  3. Navigate to Theme → Components.

  4. Create a new component.

  5. Inject the following payload in the slug field:

<script>alert('XSS')</script>

  1. Save the component.

  2. Revisit the Components page.

The injected JavaScript executes persistently within the administrative interface.

hashtag
Mitigation

  • Apply strict context-aware output encoding when rendering user-controlled input.

  • Sanitize the slug parameter before storing or rendering.

  • Upgrade to version 3.3.22, which is confirmed not vulnerable.

  • Consider implementing Content Security Policy (CSP) headers to reduce XSS impact.

hashtag
Discoverer

  • Beatriz Fresno Naumova

hashtag
References

PreviousBludit CMS Stored XSS in Post Content (CVE-2026-27742)

Last updated