CVE-2026-32277

HIGH

Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View

Title source: cna
STIX 2.1

Description

Connect-CMS is a content management system. In versions 1.35.0 through 1.41.0 and 2.35.0 through 2.41.0, a DOM-based Cross-Site Scripting (XSS) issue exists in the Cabinet Plugin list view. Versions 1.41.1 and 2.41.1 contain a patch.

References (4)

Scores

CVSS v3 8.7
EPSS 0.0001
EPSS Percentile 2.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-79
Status published
Products (4)
opensource-workshop/connect-cms 1.35.0 - 1.41.1
opensource-workshop/connect-cms 1.35.0 - 1.41.1Packagist
opensource-workshop/connect-cms >= 1.35.0, < 1.41.1
opensource-workshop/connect-cms >= 2.35.0, < 2.41.1
Published Mar 23, 2026
Tracked Since Mar 24, 2026