CVE-2026-3024 MEDIUM

CVE-2026-3024: Stored Cross-Site Scripting (XSS) vulnerability in the Wakyma application web

Vendor Wakyma
Product Wakyma application web
Weakness CWE-79 · XSS
Published March 16, 2026
Last update March 16, 2026
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Stored Cross-Site Scripting (XSS) vulnerability in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/configuracion/agenda/modelo-formulario-evento'. A user with permission to create personalized accounts could exploit this vulnerability simply by creating a malicious survey that would harm the entire veterinary team. At the same time, a user with low privileges could exploit this vulnerability to access unauthorized data and perform actions with elevated privileges.

Key dates

02Disclosure timeline

March 16, 2026 CVE published
March 16, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-52702 WordPress SEO Redirection plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability CVE-2025-2800 WP Event Manager <= 3.1.50 - Unauthenticated Stored Cross-Site Scripting via 'organizer_name' CVE-2026-6218 aandrew-me ytDownloader Error Details Panel createTextNode cross site scripting CVE-2025-7870 Portabilis i-Diario justificativas-de-falta Endpoint cross site scripting CVE-2025-68847 WordPress iSape plugin <= 0.72 - Reflected Cross Site Scripting (XSS) vulnerability