CVE-2026-4914 MEDIUM

CVE-2026-4914

Weakness CWE-79 · XSS
Published April 14, 2026
Last update April 14, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Stored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain limited information from other user sessions. User interaction is required.

Key dates

02Disclosure timeline

April 14, 2026 CVE published
April 14, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-9404 Scada-LTS Folder pointHierarchySLTS cross site scripting CVE-2024-4546 Custom Post Type Attachment <= 3.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via pdf_attachment Shortcode CVE-2026-27210 Pannellum has a XSS vulnerability in hot spot attributes CVE-2024-13584 Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.19 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-23592 WordPress dForms plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability