CVE-2026-7501mediumCWE-79CWE-94

CVE-2026-7501: medium-severity vulnerability in LinkStackOrg LinkStack

LinkStackOrg LinkStack UserController.php editPage cross site scripting

Published · Updated

Follow this CVE+ Monitor LinkStack

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.1epss 0.3%
A weakness has been identified in LinkStackOrg LinkStack up to 4.8.6. Impacted is the function editPage of the file app/Http/Controllers/UserController.php. Executing a manipulation of the argument pageDescription can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a pull request but has not reacted yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
LinkStackOrg · LinkStack
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — LinkStackOrg LinkStack

In the same product, most dangerous first.

CVE-2026-7502MEDIUMLinkStackOrg LinkStack Management Endpoint UserController.php saveLink authorizationEPSS 0.3%CVE-2026-116052MEDIUMLinkStackOrg LinkStack cross-site request forgeryEPSS 0.2%