CVE-2026-44205
Frappe: Stored Cross-Site Scripting (XSS) in User Profile through Image Upload
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
7th
Frappe is a full-stack web application framework. Prior to version 15.106.0, a stored XSS vulnerability in the user profile image section allows an attacker to execute malicious scripts in the browsers of other users. This issue has been patched in version 15.106.0.
| CWE | CWE-79 |
| Vendor | frappe |
| Product | frappe |
| Published | Jun 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for frappe frappe
Be the first to know when new unknown vulnerabilities affecting frappe frappe are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
frappe / frappe
< 15.106.0