ApostropheCMS Flaw: Stored XSS Puts User Data at Risk

The National Vulnerability Database (NVD) recently detailed CVE-2026-35569, a high-severity stored cross-site scripting (XSS) vulnerability affecting ApostropheCMS versions 4.28.0 and prior. ApostropheCMS, an open-source Node.js content management system, rendered user-controlled input in SEO fields (specifically, SEO Title and Meta Description) without proper output encoding. This oversight allowed for the injection of malicious HTML and JavaScript.

The vulnerability, scored 8.7 CVSS, meant an attacker could inject payloads like "></title><script>alert(1)</script> into these fields. When an authenticated user viewed the compromised page, the injected script would execute within their browser. This isn’t just a nuisance; it opens the door for significant compromise. According to the NVD, an attacker could leverage this to perform authenticated API requests, access sensitive data such as usernames, email addresses, and roles via internal APIs, and exfiltrate that data to an attacker-controlled server. This is a classic stored XSS scenario with serious implications for data integrity and user privacy. The issue has since been patched in version 4.29.0.