CVE-2026-1592: Stored XSS via Create New Layer Field found in Foxit PDF Editor Cloud
Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the Create New Layer feature. Unsanitized user input is embedded into the HTML output, allowing arbitrary JavaScript execution when the layer is referenced.
This issue affects pdfonline.foxit.com: before 2026‑02‑03.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1592?
CVE-2026-1592 is classified as a critical severity vulnerability due to its ability to allow arbitrary JavaScript execution.
How do I fix CVE-2026-1592?
To fix CVE-2026-1592, update your Foxit PDF Editor Cloud to the latest version released after February 2026.
What kind of vulnerability is CVE-2026-1592?
CVE-2026-1592 is a stored cross-site scripting (XSS) vulnerability that affects the Create New Layer feature.
Who is affected by CVE-2026-1592?
Users of Foxit PDF Editor Cloud versions prior to February 2026 are affected by CVE-2026-1592.
What impact does CVE-2026-1592 have?
CVE-2026-1592 can lead to unauthorized script execution, which may compromise user data and application integrity.