Stored XSS Vulnerability in Waline Comment System
CVE-2026-64670

9.3CRITICAL

Key Information:

Vendor

Walinejs

Status
Waline
Vendor
CVE Published:
11 November 2026

What is CVE-2026-64670?

The Waline comment system has a vulnerability that allows an unauthenticated commenter to leverage a stored XSS exploit. In versions 3.15.2 and earlier, the comment editor displays live previews without proper sanitization, rendering raw HTML within a user's session. This occurs when an administrator or comment owner clicks the 'Edit' button on a comment made by the attacker, inadvertently exposing them to malicious scripts. At the time of this report, no patches are available to mitigate this vulnerability. For further details, visit the security advisory.

Affected Version(s)

waline <= 3.15.2

References

https://github.com/walinejs/waline/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.