Stored Cross-Site Scripting Vulnerability in LaraDashboard by LaraTeam

CVE-2026-120488

What is CVE-2026-120488?

LaraDashboard versions prior to 1.4.9 are susceptible to a stored cross-site scripting vulnerability. This attack can occur when authenticated users with post.create or post.edit permissions inject malicious scripts through unsanitized design_json block content in the LaraBuilder. Attackers can exploit this flaw to save text-editor, HTML, text, or heading blocks containing script or event-handler markup. Consequently, these scripts are executed in administrator or Superadmin sessions when viewing the builder, preview, or page, potentially compromising sensitive administrative operations.

References