What is CVE-2026-28436?

CVE-2026-28436 is a high-severity vulnerability in Frappe, classified under Cross-site Scripting. CVSS score: 7.2/10. Published 2026-03-05.

How severe is CVE-2026-28436?

High severity. CVSS v3 base score is 7.2 out of 10.

XSS in Frappe

CVE-2026-28436

Frappe is a full-stack web application framework. Prior to versions 16.11.0 and 15.102.0, an attacker can set a crafted image URL that results in XSS when the avatar is displayed, and it can be triggered for other users via website page comments. This issue has been patched in versions 16.11.0 and 15.102.0.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (6.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.

Affected products

Frappe — versions < 16.11.0, < 15.102.0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2026-28436?: CVE-2026-28436 is a high-severity vulnerability in Frappe, classified under Cross-site Scripting. CVSS score: 7.2/10. Published 2026-03-05.
How severe is CVE-2026-28436?: High severity. CVSS v3 base score is 7.2 out of 10.