CVE-2026-126569

MEDIUM 5.4

Mbin 1.2.1 before 1.11.1 Stored XSS via Markdown Image Nested in Link

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vulnerability in EmbedElement::buildDestructed() that renders nested Markdown image alt text and URL without HTML escaping. Authenticated users can embed HTML in the alt text of an image inside a link in entries, comments, posts, messages, or bios to run script in viewers' browsers.

CWE	CWE-79
Vendor	mbinorg
Product	mbin
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for mbinorg mbin

Be the first to know when new medium vulnerabilities affecting mbinorg mbin are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

MbinOrg / mbin

1.2.1 < 1.11.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/MbinOrg/mbin/security/advisories/GHSA-g3r9-j6w4-2257 github.com: https://github.com/MbinOrg/mbin/commit/736fd39fe9cd59f5d51636d25e1857d88ddbd0bd github.com: https://github.com/MbinOrg/mbin/releases/tag/v1.11.1 github.com: https://github.com/MbinOrg/mbin/blob/v1.11.0/src/Markdown/CommonMark/EmbedElement.php#L57-L67 vulncheck.com: https://www.vulncheck.com/advisories/mbin-1.2.1-before-1.11.1-stored-xss-via-markdown-image-nested-in-link

Credits

Zachariah Mithani (AploSec)