CVE-2026-26351
published 2026-02-24CVE-2026-26351: GetSimpleCMS Community Edition (CE) versions prior to 3.3.22 (3.3.16 tested) contains a stored cross-site scripting (XSS) vulnerability in the Theme to…
PriorityP424medium4.8CVSS 3.1
AVNACLPRHUIRSCCLILAN
EPSS
0.29%
21.1th percentile
GetSimpleCMS Community Edition (CE) versions prior to 3.3.22 (3.3.16 tested) contains a stored cross-site scripting (XSS) vulnerability in the Theme to Components functionality within components.php. User-supplied input provided to the "slug" field of a component is stored without proper output encoding. While other fields are sanitized using safe_slash_html(), the slug parameter is written to XML and later rendered in the administrative interface without sanitation, resulting in persistent execution of arbitrary JavaScript. An authenticated administrator can inject malicious script content that executes whenever the affected Components page is viewed by any authenticated user, enabling session hijacking, unauthorized administrative actions, and persistent compromise of the CMS administrative interface.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getsimple-ce | getsimple_cms | >= 3.3.16 < 3.3.22 | 3.3.22 |
| getsimplecms-ce | getsimplecms-ce | — | — |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
nvdv4.04.8MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
GetSimpleCMS Community Edition up to 3.3.16/3.3.21 components.php safe_slash_html slug cross site scripting (GHSA-95f7-vm92-8gpx)
vuldb·2026-05-26·CVSS 4.8
CVE-2026-26351 [MEDIUM] GetSimpleCMS Community Edition up to 3.3.16/3.3.21 components.php safe_slash_html slug cross site scripting (GHSA-95f7-vm92-8gpx)
A vulnerability has been found in GetSimpleCMS Community Edition up to 3.3.16/3.3.21 and classified as problematic. Affected by this vulnerability is the function safe_slash_html of the file components.php. Performing a manipulation of the argument slug results in cross site scripting.
This vulnerability is identified as CVE-2026-26351. The attack can be initiated remotely. There is not any exploit available.
The affected component should be upgraded.
GHSA
GHSA-98hq-gxg8-fchj: GetSimpleCMS Community Edition (CE) version 3
ghsa_unreviewed·2026-02-25
CVE-2026-26351 [MEDIUM] CWE-79 GHSA-98hq-gxg8-fchj: GetSimpleCMS Community Edition (CE) version 3
GetSimpleCMS Community Edition (CE) version 3.3.16 contains a stored cross-site scripting (XSS) vulnerability in the Theme to Components functionality within components.php. User-supplied input provided to the "slug" field of a component is stored without proper output encoding. While other fields are sanitized using safe_slash_html(), the slug parameter is written to XML and later rendered in the administrative interface without sanitation, resulting in persistent execution of arbitrary JavaScript. An authenticated administrator can inject malicious script content that executes whenever the affected Components page is viewed by any authenticated user, enabling session hijacking, unauthorized administrative actions, and persistent compromise of the CMS administrative interface.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-02-24
Published