What’s Vulnerable › Vulnerabilities
CVE-2026-21825: HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-05 · updated 2026-07-23
- Weakness: CWE-79
Description
HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center. An attacker could execute arbitrary JavaScript in the victim's browser.
Affected products
- HCL Digital Experience: 9.5, 9.5-cf17, 9.5-cf171, 9.5-cf172, 9.5-cf173, 9.5-cf18 (+49)
- Hcltech Digital Experience Compose: 9.5, 9.5-cf224, 9.5-cf225, 9.5-cf226, 9.5-cf227, 9.5-cf228 (+6)
References
Get alerted when CVE-2026-21825 or the next vulnerability affects your stack