What’s Vulnerable › Products

GetSimpleCMS-CE vulnerabilities

18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 18 published in the last 12 months.

Check whether your GetSimpleCMS-CE version is affected

Latest GetSimpleCMS-CE vulnerabilities

CVE-2026-71542 — GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php (CVSS 8.7)
CVE-2026-71426 — GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field (CVSS 7.1)
CVE-2026-70650 — GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and content (CVSS 8.8)
CVE-2026-56662 — GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request (CVSS 9.6)
CVE-2026-56661 — GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint (CVSS 7.5)
CVE-2026-56660 — GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction (CVSS 9.1)
CVE-2026-53953 — GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover (CVSS 9.1)
CVE-2026-53952 — GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw (CVSS 9.8)
CVE-2026-28495 — GetSimple CMS has CSRF to Remote Code Execution via Arbitrary PHP Write in gsconfig.php (CVSS 8.8)
CVE-2026-26351 — GetSimpleCMS-CE < 3.3.22 Stored XSS via components.php (CVSS 4.8)
CVE-2026-27202 — GetSimple CMS: Uploaded Files (feature) Arbitrary File Read Vulnerability (CVSS 7.5)
CVE-2026-27161 — Unauthenticated Information Disclosure via .htaccess Reliance in Sensitive Directories (CVSS 7.5)
CVE-2026-27147 — GetSimple CMS: Stored Cross-Site Scripting (XSS) via SVG File Upload (Authenticated) (CVSS 5.4)
CVE-2026-27146 — GetSimple CMS: Cross-Site Request Forgery (CSRF) in File Upload Allows Arbitrary Uploads (CVSS 4.5)
CVE-2025-48492 — GetSimple CMS RCE in Edit component (CVSS 8.8)
CVE-2024-55088 — (CVSS 8.8)
CVE-2024-55086 — (CVSS 7.2)
CVE-2024-55085 — (CVSS 9.8)