CVE-2026-18741: Worksuite SaaS version prior to 6.0.14 Stored XSS via Asset Management Location and Description Fields
Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset. Attackers can store crafted HTML script tags in the application database that execute automatically in the browsers of any user who views the affected asset, potentially leading to session hijacking, credential theft, and unauthorized actions on behalf of authenticated users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Worksuite SaaSto a version that resolves this vulnerability.Fixed in 6.0.14 - Configuration
In Asset Management, ensure administrators cannot enter crafted HTML/script payloads into the Location and Description fields when creating or updating assets (validate/sanitize these inputs to prevent stored XSS).
Worksuite SaaS Asset Management Location and Description fields (asset creation/editing) = Do not allow HTML/script tag input
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18741?
The severity of CVE-2026-18741 is rated as medium with a score of 4.8.
How do I fix CVE-2026-18741?
To fix CVE-2026-18741, upgrade Worksuite SaaS to version 6.0.14 or later.
What type of vulnerability is CVE-2026-18741?
CVE-2026-18741 is a stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-18741?
CVE-2026-18741 affects authenticated administrators using Worksuite SaaS versions prior to 6.0.14.
What can an attacker do with CVE-2026-18741?
An attacker can inject arbitrary JavaScript into the Asset Management module by exploiting the Location and Description fields.