CVE-2026-23928 Stored XSS vulnerability in the Item history/Plain text widget
Attackers can inject JavaScript via monitored hosts to execute code in victim dashboards when HTML display is enabled, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-23928?
CVE-2026-23928 is a high-severity cross-site scripting vulnerability in Zabbix Zabbix, published on 6 May 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized actions depending on which user opens a dashboard containing these widgets. The malicious JavaScript would have to come from a monitored host controlled by the attacker. Note: the Item history widget is a replacement for the Plain text widget since Zabbix 7.0.
Weakness: CWE-79
Which versions are affected by CVE-2026-23928?
It affects 1 product.
Products include Zabbix Zabbix.
How do I fix CVE-2026-23928?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-23928 being exploited?
There is no known exploitation of CVE-2026-23928 in the wild and no public exploit code.
Other vulnerabilities in Zabbix Zabbix
Sources
Also known as DEBIAN-CVE-2026-23928, GHSA-qjqp-r6hf-xpqh, UBUNTU-CVE-2026-23928.