What’s Vulnerable › Vulnerabilities

CVE-2026-5362: Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-27 · updated 2026-06-17
• Weakness: CWE-79

Description

An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution when the published page is rendered. This issue affects pimcore: v12.3.3.

Affected products

• pimcore/pimcore: 12.3.3

References

• https://fluidattacks.com/es/advisories/mago
• https://github.com/pimcore/pimcore/

Get alerted when CVE-2026-5362 or the next vulnerability affects your stack