CVE-2026-1592CWE-79

Stored XSS via Create New Layer Field found in Foxit PDF Editor Cloud

Medium · published February 3, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
12.8
In the wild
Unconfirmed
What it is

Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the Create New Layer feature. Unsanitized user input is embedded into the HTML output, allowing arbitrary JavaScript execution when the layer is referenced.

This issue affects pdfonline.foxit.com: before 2026‑02‑03.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00228 · 12.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-02-03T07:59Z
EPSS history
Timeline
  • 03 FEB 07:59Z
    Stored XSS via Create New Layer Field found in Foxit PDF Editor Cloud
    cvelistv5