CVE-2026-14449

POST-based reflected XSS via the thanks parameter in form components

Medium · published July 2, 2026

CVSS v4.0
6.4
EPSS
0%
Percentile
36.9
In the wild
Unconfirmed
What it is

u5CMS through v12.8.8 is vulnerable to reflected XSS via the ‘thanks’ parameter in multiple form components

The record
Technical detail
CVSS v4.0
6.4 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H
EPSS
0.00436 · 36.9th percentile
Published
2026-07-02T11:47Z
EPSS history
Timeline
  • 02 JUL 11:47Z
    POST-based reflected XSS via the thanks parameter in form components
    cvelistv5