Description
WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft.
This issue has been fixed in version 2.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fundacja Widzialni | WidzialniCMS | < 2.5 | 2.5 |
References
- https://cert.pl/posts/2026/11/CVE-2026-110468 third-party-advisory
- https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175 product