CVE-2026-40230CWE-79

Helpy 2.8.0 - Stored XSS in knowledgebase Doc body rendering

Medium · published April 29, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
16.9
In the wild
Unconfirmed
What it is

Helpy contains a stored cross-site scripting vulnerability in the knowledge base Doc rendering logic. An authenticated attacker with admin or agent editor privileges can persist arbitrary HTML or JavaScript in the body field of a knowledge base Doc.This issue affects helpy: 2.8.0.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00261 · 16.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-04-29T15:39Z
EPSS history
Timeline
  • 29 APR 15:39Z
    Helpy 2.8.0 - Stored XSS in knowledgebase Doc body rendering
    cvelistv5