CVE-2026-126498: WriteFreely before 0.17.3 Stored XSS via Unsanitized Post Slug

Q: Who can exploit this vulnerability?

An authenticated WriteFreely author can exploit it by submitting a malicious post slug through the CreatePost API. Exploitation requires a victim to view the resulting content through an RSS or Atom feed, a newsletter, or ActivityPub.

Q: Which deployments are exposed?

The issue affects WriteFreely versions before 0.17.3 where paid-shortcode posts are processed by augmentReadingDestination(). The supplied information does not establish whether paid shortcodes are enabled by default.

Q: What is the impact on readers and subscribers?

A malicious slug is stored and inserted into an anchor without sanitization, allowing injected HTML and script to execute in affected downstream readers. RSS/Atom subscribers, newsletter recipients, and ActivityPub viewers may be exposed when they render the crafted post.

Q: How can I remediate the issue?

Upgrade WriteFreely to version 0.17.3 or later. If upgrading cannot happen immediately, the provided information supports restricting access to the CreatePost API for untrusted authors and avoiding publication of untrusted paid-shortcode posts.

Published Nov 11, 2026

Updated

WriteFreely before 0.17.3 contains a stored cross-site scripting vulnerability that allows authenticated authors to inject HTML by supplying a malicious post slug via the CreatePost API. The raw slug is concatenated into an anchor by augmentReadingDestination() for paid-shortcode posts, executing script for RSS/Atom feed readers, newsletter recipients and ActivityPub viewers.

Affected Software

1 affected component

Writefreely Writefreely<0.17.3

Event History

Nov 11, 2026

CVE Published

via MITRE·12:58 AM

Data Sourced

via MITRE·12:58 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An authenticated WriteFreely author can exploit it by submitting a malicious post slug through the CreatePost API. Exploitation requires a victim to view the resulting content through an RSS or Atom feed, a newsletter, or ActivityPub.

Which deployments are exposed?

The issue affects WriteFreely versions before 0.17.3 where paid-shortcode posts are processed by augmentReadingDestination(). The supplied information does not establish whether paid shortcodes are enabled by default.

What is the impact on readers and subscribers?

A malicious slug is stored and inserted into an anchor without sanitization, allowing injected HTML and script to execute in affected downstream readers. RSS/Atom subscribers, newsletter recipients, and ActivityPub viewers may be exposed when they render the crafted post.

How can I remediate the issue?

Upgrade WriteFreely to version 0.17.3 or later. If upgrading cannot happen immediately, the provided information supports restricting access to the CreatePost API for untrusted authors and avoiding publication of untrusted paid-shortcode posts.

CVE-2026-126498: WriteFreely before 0.17.3 Stored XSS via Unsanitized Post Slug

Affected Software

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

Which deployments are exposed?

What is the impact on readers and subscribers?

How can I remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

Which deployments are exposed?

What is the impact on readers and subscribers?

How can I remediate the issue?