CVE-2026-18526CWE-79cross-site-scripting

CVE-2026-18526

published August 19, 2026

CVSS
7.4
EPSS
0%
Percentile
38.8
In the wild
Unconfirmed
What it is

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow.

The record
Technical detail
CVSS
7.4 · NONE
CVSS v4.0
7.4 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
EPSS
0.00460 · 38.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-19T19:16Z
References (3)
https://fluidattacks.com/advisories/greeicy · [email protected]https://github.com/humhub/humhub · [email protected]https://github.com/humhub/humhub/pull/8373 · [email protected]
EPSS history
Timeline
  • 19 AUG 14:17Z
    HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation
    cvelistv5