What’s Vulnerable › Vulnerabilities

CVE-2021-32856: Microweber vulnerable to Cross-site Scripting

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-02-21 · updated 2026-06-17
• Weakness: CWE-79

Description

Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. A fix was attempted in versions 1.2.9 and 1.2.12, but it is incomplete.

Affected products

• microweber/microweber: through 1.2.12

References

• https://github.com/microweber/microweber/commit/f3b86d59ab674dbf514f9f9948ddfa091739ab75
• https://securitylab.github.com/advisories/GHSL-2021-1005-Microweber/
• https://github.com/microweber/microweber/commit/f3b86d59ab674dbf514f9f9948ddfa091739ab75
• https://securitylab.github.com/advisories/GHSL-2021-1005-Microweber/

Get alerted when CVE-2021-32856 or the next vulnerability affects your stack