CVE-2026-89145lowCWE-79

CVE-2026-89145: low-severity vulnerability in flextype

Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory

Published

Follow this CVE+ Monitor flextype

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.4epss 0.2%
Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts in users' browsers when dependency validation fails.
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
flextype · flextype
Related CVEs — flextype

In the same product, most dangerous first.

CVE-2026-77939HIGHFlextype CMS 1.0.0-dev RCE via POST /api/v1/query EndpointEPSS 0.6%CVE-2026-88897HIGHFlextype CMS through 1.0.0-alpha.3 API Token Exposure via Query StringEPSS 0.6%CVE-2026-91751HIGHFlextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST APIEPSS 0.5%