CVE-2026-2680 MEDIUM

CVE-2026-2680: Multiple vulnerabilities in A3factura software

Vendor A3Factura

Product A3factura

Weakness CWE-79 · XSS

Published February 26, 2026

Last update February 26, 2026

View on NVD All CVEs

CVSS base score

4.8/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerVATNumber', in 'a3factura-app.wolterskluwer.es/#/incomes/salesDeliveryNotes' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser.

Key dates

02Disclosure timeline

February 26, 2026 CVE published

February 26, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-2680 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2022-37402 WordPress AFS Analytics Plugin <= 4.18 is vulnerable to Cross Site Scripting (XSS) CVE-2019-1949 Cisco Firepower Management Center Persistent Cross-Site Scripting Vulnerability CVE-2024-8989 Stars Testimonials <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via stars_testimonials Shortcode CVE-2026-40927 Docmost: XSS in Comments with JavaScript URI CVE-2025-1461 Vuetify XSS through 'eventMoreText' prop of VCalendar