What’s Vulnerable › Vulnerabilities

CVE-2026-73628: Serendipity 2.3.5 Reflected XSS via search clean-URL route

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-13 · updated 2026-10-24
• Weakness: CWE-79

Description

Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/functions_routing.inc.php serveSearch(), the sanitisation pipeline runs urldecode() after HTML-encoding, so a single URL-encoded HTML payload survives strip_tags() and htmlspecialchars() and is then decoded back into live HTML in the page. A crafted search link can execute arbitrary JavaScript in the victim's browser. Fixed in 2.6.1.

Affected products

• s9y Serendipity: from 2.3.5 through 2.6.0

References

• https://github.com/s9y/Serendipity/security/advisories/GHSA-6c2x-mjmq-vx4q
• https://www.vulncheck.com/advisories/serendipity-reflected-xss-via-search-clean-url-route
• https://github.com/s9y/Serendipity/security/advisories/GHSA-6c2x-mjmq-vx4q

Get alerted when CVE-2026-73628 or the next vulnerability affects your stack