CVE-2026-22704

CVE-2026-22704 · HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover

This page contains facts from public vulnerability sources. Check the original advisory before updating.

HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0.

CVSS 8.1 · High · EPSS 1.0% · Public exploit · Fix available

Published: 2026-01-10T06:22:45.076Z
Updated: 2026-01-13T15:09:03.814Z

Stack: node

Affected products and versions

issues
Versions
- >= 11.0.6, < 25.0.0: Affected
No fix published
@haxtheweb/haxcms-nodejs npm
Affected ranges
- SEMVER: ≥ 11.0.6, < 25.0.0
Update to 25.0.0

Original sources

https://github.com/haxtheweb/issues/security/advisories/GHSA-3fm2-xfq7-7778
https://github.com/haxtheweb/haxcms-nodejs/commit/317a8ae29f88be389f7cfeffaef416957122d97e
https://github.com/haxtheweb/haxcms-nodejs/releases/tag/v25.0.0
https://nvd.nist.gov/vuln/detail/CVE-2026-22704

Check your server →

CVE-2026-22704 · HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover

Affected products and versions

issues

@haxtheweb/haxcms-nodejs npm

Original sources