CVE-2026-71542 GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php
Attackers can inject persistent JavaScript into the admin panel via the title parameter, potentially leading to session hijacking or admin account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-71542?
CVE-2026-71542 is a high-severity cross-site scripting vulnerability in GetSimpleCMS-CE, published on 1 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting (XSS) in the "Theme to Components" functionality (admin/components.php) via the title parameter. The stored title is rendered inside a double-quoted HTML attribute in the administrative interface through an output path that HTML-entity-decodes the value before printing it, without re-encoding for the attribute context. This allows persistent execution of arbitrary JavaScript in the admin panel. At time of publication, there are no publicly available patches.
Weakness: CWE-79
Which versions are affected by CVE-2026-71542?
How do I fix CVE-2026-71542?
No fix has been published for CVE-2026-71542 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-71542 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-71542 exists.
Sources
Also known as GHSA-vqfh-838q-xfqh.