CVE-2026-19988CWE-74CWE-80

CVE-2026-19988

Medium · published August 17, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
38.0
In the wild
Unconfirmed
What it is

A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component Popup UI. Performing a manipulation results in basic cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00449 · 38.0th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2026-08-17T10:17Z
References (5)
https://vuldb.com/cve/CVE-2026-19988 · [email protected]https://vuldb.com/submit/873939 · [email protected]https://vuldb.com/vuln/391192 · [email protected]https://vuldb.com/vuln/391192/cti · [email protected]https://github.com/xryj920/chrome_extensions/blob/main/Alaev%20%26%20Co%20Alaev%20SEO%20Tools%201.0.10%20allows%20extension%20popup%20UI%20injection%20through%20unsanitized%20page%20SEO%20fields · [email protected]
EPSS history
Timeline
  • 17 AUG 05:30Z
    Alaev SEO Tools Extension Popup UI popup.html addDiv cross site scripting
    cvelistv5