Skip to content
OpenAdvisories

Vendor

walinejs

3 known vulnerabilities.

Products

waline 3
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.2
    CVE-2026-64671

    Stored XSS in the @waline/client UserList widget via an unescaped commenter link field

    Waline is a comment system with backend support. In versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The commenter nick and link …

    walinejs waline