hexo-admin plugin for Node.js XSS Vulnerability

Description

The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content of a post.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.3.0

References

• GHSA-g784-q3p3-26rm
• CVE-2019-17606
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability - CVE-2024-43407
• Cross-Site Scripting in hexo-admin - Vulnerability
• TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - CVE-2026-47761
• @vendure/admin-ui-plugin authenticated Cross-site Scripting vulnerability - Vulnerability

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

These 7 PHP mistakes leave your website open to the hackers

Tags:

npm

hexo-admin