CVE-2026-109633: Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page

Q: Which deployments are most exposed?

ERPNext instances that expose a public-facing booking page and have privileged users review submitted booking content are exposed to the attack path described.

Q: What does an attacker need to exploit this issue?

The attacker does not need authentication and can submit crafted content through the public booking page. Exploitation also requires a privileged user to render the stored content in their browser.

Q: How can I determine whether my instance needs remediation?

Instances running ERPNext versions earlier than 15.119.1 in the 15.x line, or earlier than 16.32.0 in the 16.x line, are affected according to the advisory. Confirm whether the instance also makes the booking page publicly reachable.

Q: What is the impact after successful exploitation?

Script executes in the privileged user's session and can act with that user's permissions. The advisory states this can enable takeover of the privileged user's account.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a privileged user's session, executing script to act as that user and take over the account.

Affected Software

1 affected component

Frappe ERPNext<15.119.1, >=16.0.0<16.32.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are most exposed?

ERPNext instances that expose a public-facing booking page and have privileged users review submitted booking content are exposed to the attack path described.

What does an attacker need to exploit this issue?

The attacker does not need authentication and can submit crafted content through the public booking page. Exploitation also requires a privileged user to render the stored content in their browser.

How can I determine whether my instance needs remediation?

Instances running ERPNext versions earlier than 15.119.1 in the 15.x line, or earlier than 16.32.0 in the 16.x line, are affected according to the advisory. Confirm whether the instance also makes the booking page publicly reachable.

What is the impact after successful exploitation?

Script executes in the privileged user's session and can act with that user's permissions. The advisory states this can enable takeover of the privileged user's account.

CVE-2026-109633: Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page

Affected Software

Event History

Frequently Asked Questions

Which deployments are most exposed?

What does an attacker need to exploit this issue?

How can I determine whether my instance needs remediation?

What is the impact after successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed?

What does an attacker need to exploit this issue?

How can I determine whether my instance needs remediation?

What is the impact after successful exploitation?