CVE-2026-71542
GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting (XSS) in the "Theme to Components" functionality (admin/components.php) via the title parameter. The stored title is rendered inside a double-quoted HTML attribute in the administrative interface through an output path that HTML-entity-decodes the value before printing it, without re-encoding for the attribute context. This allows persistent execution of arbitrary JavaScript in the admin panel. At time of publication, there are no publicly available patches.
| CWE | CWE-79 |
| Vendor | getsimplecms-ce |
| Product | getsimplecms-ce |
| Published | Oct 1, 2026 |
| Last Updated | Oct 1, 2026 |
Get instant alerts for getsimplecms-ce getsimplecms-ce
Be the first to know when new unknown vulnerabilities affecting getsimplecms-ce getsimplecms-ce are published — delivered to Slack, Telegram or Discord.