Stored Cross-Site Scripting Vulnerability in ElkArte Forum by ElkArte
CVE-2026-72553

5.4MEDIUM

Key Information:

Vendor

Elkarte Forum

Status
Elkarte
Vendor
CVE Published:
11 August 2026

What is CVE-2026-72553?

ElkArte Forum 2.0 Beta 1 contains a stored cross-site scripting vulnerability that permits registered users to inject malicious JavaScript into profile fields, specifically cust_blurb and cust_locate. This unencoded data is then rendered unescaped in profile views, which can be accessed by administrators. An attacker can exploit this vulnerability to execute their payload within an administrator's session, posing significant risks such as session hijacking and potential privilege escalation.

Affected Version(s)

ElkArte 0 <= 2.0 Beta 1

References

https://github.com/elkarte/Elkarte

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bobur Abdugafforov
.