CVE-2026-88415: XSS

Q: What access would an attacker need to exploit this issue?

The attacker would need a way to submit or modify article content in the contentDetails field. Payloads placed in that field can be stored because it is excluded from the global XSS filter.

Q: Does the global XSS filter mitigate XSS in article content?

No. The contentDetails field is specifically excluded from the global XSS filter, so that filter does not protect article content submitted through this field.

Published Sep 22, 2026

Updated

MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). The article content field contentDetails is excluded from the global XSS filter.

Affected Software

1 affected component

MCMS>=6.1.1<=6.2.1

Event History

Sep 22, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·07:16 PM

Description

Frequently Asked Questions

What access would an attacker need to exploit this issue?

The attacker would need a way to submit or modify article content in the contentDetails field. Payloads placed in that field can be stored because it is excluded from the global XSS filter.

Does the global XSS filter mitigate XSS in article content?

No. The contentDetails field is specifically excluded from the global XSS filter, so that filter does not protect article content submitted through this field.