GHSA-cwxm-8ch5-j2vh: WriteFreely before 0.17.3 Stored XSS via Unsanitized Post Slug

Published Nov 11, 2026

Updated

WriteFreely before 0.17.3 contains a stored cross-site scripting vulnerability that allows authenticated authors to inject HTML by supplying a malicious post slug via the CreatePost API. The raw slug is concatenated into an anchor by augmentReadingDestination() for paid-shortcode posts, executing script for RSS/Atom feed readers, newsletter recipients and ActivityPub viewers.

Event History

Nov 11, 2026

CVE Published

via OSV·12:58 AM

Data Sourced

via OSV·12:58 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to the injected script?

The payload can execute for people who consume affected paid-shortcode posts through RSS or Atom feeds, newsletters, or ActivityPub. Exploitation requires an authenticated author to create the malicious post.

Does exploitation require a victim to interact with the post?

Yes. The attack vector includes user interaction: a recipient or viewer must open or process content containing the affected post through one of the listed delivery channels.

What should be done if upgrading is not immediately possible?

The provided information does not describe a workaround. As an interim exposure-reduction measure, restrict untrusted authors' ability to create posts, particularly paid-shortcode posts, until an update can be applied.

How can administrators identify potentially malicious content?

Review post slugs submitted through the CreatePost API, especially for paid-shortcode posts, for HTML or script-like characters. The vulnerable behavior uses the raw slug when constructing an anchor destination.

GHSA-cwxm-8ch5-j2vh: WriteFreely before 0.17.3 Stored XSS via Unsanitized Post Slug

Event History

Frequently Asked Questions

Who is exposed to the injected script?

Does exploitation require a victim to interact with the post?

What should be done if upgrading is not immediately possible?

How can administrators identify potentially malicious content?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to the injected script?

Does exploitation require a victim to interact with the post?

What should be done if upgrading is not immediately possible?

How can administrators identify potentially malicious content?