CVE-2026-72553: ElkArte Forum ElkArte - Cross-Site Scripting

Published Aug 11, 2026

Updated

A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields custblurb and custlocate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An attacker can craft a payload that executes in an administrator session, enabling session hijacking or privilege escalation.

Affected Software

1 affected component

ElkArte ElkArte Forum=2.0 Beta 1

Event History

Aug 11, 2026

CVE Published

via MITRE·11:11 AM

Data Sourced

via MITRE·11:11 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-72553?

CVE-2026-72553 has a medium severity rating of 5.4.

How do I fix CVE-2026-72553?

To fix CVE-2026-72553, ensure that user input in the cust_blurb and cust_locate fields is properly sanitized and encoded before rendering.

What type of vulnerability is CVE-2026-72553?

CVE-2026-72553 is a stored cross-site scripting (XSS) vulnerability.

What software is affected by CVE-2026-72553?

CVE-2026-72553 affects ElkArte Forum version 2.0 Beta 1.

Who is impacted by CVE-2026-72553?

Any registered member of the ElkArte Forum can exploit CVE-2026-72553 to inject persistent JavaScript.

CVE-2026-72553: ElkArte Forum ElkArte - Cross-Site Scripting

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-72553?

How do I fix CVE-2026-72553?

What type of vulnerability is CVE-2026-72553?

What software is affected by CVE-2026-72553?

Who is impacted by CVE-2026-72553?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-72553?

How do I fix CVE-2026-72553?

What type of vulnerability is CVE-2026-72553?

What software is affected by CVE-2026-72553?

Who is impacted by CVE-2026-72553?