XSS in Haxtheweb Haxcms-nodejs

CVE-2026-46496

HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of the `<video-player>` component. The component allows…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (13.8th percentile) — read the EPSS interpretation.

Affected products

Haxtheweb Haxcms-nodejs — versions < 26.0.0
Haxtheweb Video-player — versions < 26.0.0

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM)