Cross Site Scripting Vulnerability in LinkStackOrg LinkStack Product
CVE-2026-7501

5.1MEDIUM

Key Information:

Vendor: Linkstackorg
Status: Linkstack
Vendor: CVE Published:; 30 April 2026

🔔 Create Linkstackorg Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-7501?

A cross site scripting vulnerability exists in the LinkStackOrg LinkStack product, specifically in version 4.8.6. This weakness affects the 'editPage' function located in the file 'app/Http/Controllers/UserController.php'. A manipulation of the 'pageDescription' argument can allow an attacker to inject malicious scripts, leading to potential remote exploitation. Despite the identification of this issue and early notification through a pull request, no remedy has been implemented yet, leaving the system vulnerable. The exploit for this vulnerability is publicly accessible, indicating a pressing need for users to apply protective measures.

Affected Version(s)

LinkStack 4.8.0

LinkStack 4.8.1

LinkStack 4.8.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-7501 - Proof of Concept