Stored Cross-Site Scripting Vulnerability in WriteFreely by WriteFreely
CVE-2026-126498

5.1MEDIUM

Key Information:

Vendor: Musing Studio
Status: Writefreely
Vendor: CVE Published:; 11 November 2026

🔔 Create Musing Studio Vulnerability Alert

What is CVE-2026-126498?

WriteFreely versions prior to 0.17.3 are vulnerable to a stored cross-site scripting issue. Authenticated authors can exploit this vulnerability by crafting a malicious post slug through the CreatePost API. This unsanitized slug is then integrated into an anchor tag via the augmentReadingDestination() function, potentially executing scripts in the context of various feed readers, newsletters, and ActivityPub viewers. This vulnerability poses serious security risks, allowing for the execution of arbitrary JavaScript in the user's browser.