CVE-2020-26046

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-01-05 · updated 2026-06-17
Weakness: CWE-79

Description

FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account and also impact other visitors.

Affected products

Thedaylightstudio Fuel Cms: 1.4.11

References

https://getfuelcms.com
https://github.com/daylightstudio/FUEL-CMS/issues/574
https://getfuelcms.com
https://github.com/daylightstudio/FUEL-CMS/issues/574

Get alerted when CVE-2020-26046 or the next vulnerability affects your stack