CVE-2026-46496 CRITICAL

CVE-2026-46496: HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft

Vendor Haxtheweb
Product haxcms-nodejs
Weakness CWE-79 · XSS
Published June 5, 2026
Last update June 5, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

What the vulnerability does

Description

HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of the `<video-player>` component. The component allows `javascript:` URIs in the `source` attribute, which are executed when the page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data such as JWT tokens and more. Version 26.0.0 fixes the issue.

Key dates

Disclosure timeline

June 5, 2026 CVE published
June 5, 2026 Record updated