Stored Cross-Site Scripting in Waline Comment System
CVE-2026-64671

7.2HIGH

Key Information:

Vendor

Walinejs

Status
Waline
Vendor
CVE Published:
11 November 2026

What is CVE-2026-64671?

The Waline comment system, in versions 3.15.2 and earlier, is susceptible to stored cross-site scripting vulnerabilities via the UserList widget. This occurs when unescaped user input is directly injected into the page's DOM without proper sanitization. An unauthenticated user can exploit this by posting a comment that includes a malicious link, which will be executed in the browsers of all users viewing the page. At the time of publication, there are no available patches to mitigate this security issue, making it imperative for users of Waline to be alert.

Affected Version(s)

waline <= 3.15.2

References

https://github.com/walinejs/waline/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.