What is CVE-2026-90943?

CVE-2026-90943 is a high-severity vulnerability in Parallax Filament-Comments, classified under Cross-site Scripting. CVSS score: 8.7/10. Published 2026-09-14.

How severe is CVE-2026-90943?

High severity. CVSS v3 base score is 8.7 out of 10.

XSS in Parallax Filament-Comments

CVE-2026-90943

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those comments, including administrators, enabling session token theft and unauthorized actions.

Vulnerability class: XSS (Cross-Site Scripting)

CVSS v3 metric

CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N.

Affected products

Parallax Filament-comments

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

disclosure@vulncheck.com (technical-description, third-party-advisory)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-90943?: CVE-2026-90943 is a high-severity vulnerability in Parallax Filament-Comments, classified under Cross-site Scripting. CVSS score: 8.7/10. Published 2026-09-14.
How severe is CVE-2026-90943?: High severity. CVSS v3 base score is 8.7 out of 10.