CVE-2026-120488
LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with post.create or post.edit permission to inject scripts via unsanitized LaraBuilder design_json block content. Attackers can save text-editor, HTML, text or heading blocks containing script or event-handler markup that executes in administrator or Superadmin sessions viewing the builder, preview or page.
| CWE | CWE-79 |
| Vendor | laradashboard |
| Product | laradashboard |
| Published | Nov 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for laradashboard laradashboard
Be the first to know when new medium vulnerabilities affecting laradashboard laradashboard are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
LaraDashboard / LaraDashboard
0 < 1.4.9
References
github.com: https://github.com/laradashboard/laradashboard/security/advisories/GHSA-w878-x2w9-3r6f github.com: https://github.com/laradashboard/laradashboard/security/advisories/GHSA-rf5h-55h2-jmf8 github.com: https://github.com/laradashboard/laradashboard/security/advisories/GHSA-9gg9-jh9p-fw37 github.com: https://github.com/laradashboard/laradashboard/commit/5955d725683b1e63af8c38a149211d6151465aed github.com: https://github.com/laradashboard/laradashboard/releases/tag/v1.4.9 github.com: https://github.com/laradashboard/laradashboard/blob/v1.4.8/resources/js/lara-builder/blocks/text-editor/render.php#L99-L104 vulncheck.com: https://www.vulncheck.com/advisories/laradashboard-before-1.4.9-stored-xss-via-larabuilder-design-json-block-content
Credits
EVIL0RD Hiroki6