Description
CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder module. The origin validation in src/modules/visualBuilder/pageBuilder.js (lines 56-60) uses the includes() method to verify the originUrl contains “dashboard.clevertap.
Recommendation
Update the clevertap-web-sdk package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.15.3
- Patched version(s): 1.15.3
References
Could your website be exposed too?
SmartScanner can check your website for CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage and gives you actionable findings to investigate.
Start a free scanRelated Issues
- CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function - CVE-2026-26861
- Svelte SSR vulnerable to cross-site scripting via spread attributes - CVE-2026-42599
- Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization - CVE-2026-65841
- jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin - CVE-2025-9910
You might also like:
See something that needs correcting? Let us knowUpdated March 01, 2026