What’s Vulnerable › Vulnerabilities

CVE-2026-32278: Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-23 · updated 2026-06-17
• Weakness: CWE-434

Description

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Stored Cross-site Scripting (XSS) issue exists in the file field of the Form Plugin. Versions 1.41.1 and 2.41.1 contain a patch.

Affected products

• opensource-workshop connect-cms: from 1.0.0 before 1.41.1; from 2.0.0 before 2.41.1 — fixed in 1.41.1, 2.41.1

How to fix

Upgrade to a fixed version: opensource-workshop connect-cms 1.41.1, 2.41.1. Check the vendor advisory for mitigations.

References

• https://github.com/opensource-workshop/connect-cms/commit/9d87fe8ecf7f57efbb0e5231be058807734c96b3
• https://github.com/opensource-workshop/connect-cms/releases/tag/v1.41.1
• https://github.com/opensource-workshop/connect-cms/releases/tag/v2.41.1
• https://github.com/opensource-workshop/connect-cms/security/advisories/GHSA-mv3p-7p89-wq9p

Get alerted when CVE-2026-32278 or the next vulnerability affects your stack