CVE-2016-20098
Moderator Toolbox before 4.0.14 Stored XSS via Removal Reasons Configuration
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vulnerability in the removalreasons module, which inserts subreddit toolbox wiki fields into popup HTML without encoding. Attackers who can edit the toolbox wiki page can plant JavaScript in fields like pmsubject, header, or reason titles to act with moderators' Reddit sessions.
| CWE | CWE-79 |
| Vendor | toolbox-team |
| Product | reddit-moderator-toolbox |
| Published | Oct 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for toolbox-team reddit-moderator-toolbox
Be the first to know when new medium vulnerabilities affecting toolbox-team reddit-moderator-toolbox are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
toolbox-team / reddit-moderator-toolbox
0 < 4.0.14
References
github.com: https://github.com/toolbox-team/reddit-moderator-toolbox/commit/26f45ba21d84cecb92b1a820896ad3bf5254376e github.com: https://github.com/toolbox-team/reddit-moderator-toolbox vulncheck.com: https://www.vulncheck.com/advisories/moderator-toolbox-before-4.0.14-stored-xss-via-removal-reasons-configuration
Credits
Kevin Tabb