What’s Vulnerable › Vulnerabilities

CVE-2026-11975: Stored Cross-Site Scripting (XSS) in SimplCommerce News Module Admin Interface

• Severity: medium (CVSS 6.2 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-17 · updated 2026-06-17
• Weakness: CWE-79

Description

Stored cross-site scripting (XSS) in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authenticated administrator to execute arbitrary JavaScript via the ShortContent and FullContent fields, which are stored without HTML sanitization and rendered unencoded via @Html.Raw()

Affected products

• SimplCommerce: all versions

References

• https://github.com/simplcommerce/SimplCommerce/commit/6142d3b5147899e0edb41663ae20183878ab39f7
• https://github.com/simplcommerce/SimplCommerce/pull/1151

Get alerted when CVE-2026-11975 or the next vulnerability affects your stack