p PatchFirst

CVE-2026-32277

CVE-2026-32277 · Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Connect-CMS is a content management system. In versions 1.35.0 through 1.41.0 and 2.35.0 through 2.41.0, a DOM-based Cross-Site Scripting (XSS) issue exists in the Cabinet Plugin list view. Versions 1.41.1 and 2.41.1 contain a patch.

CVSS 8.7 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • connect-cms

    Versions
    • >= 1.35.0, < 1.41.1: Affected
    • >= 2.35.0, < 2.41.1: Affected

    No fix published

  • opensource-workshop/connect-cms Packagist

    Versions
    • v1.35.0
    • v1.36.0
    • v1.37.0
    • v1.38.0
    • v1.38.1
    • v1.39.0
    • v1.40.0
    • v1.41.0
    Affected ranges
    • ECOSYSTEM: ≥ 1.35.0, < 1.41.1

    Update to 1.41.1

  • opensource-workshop/connect-cms Packagist

    Versions
    • v2.35.0
    • v2.36.0
    • v2.37.0
    • v2.38.0
    • v2.38.1
    • v2.39.0
    • v2.40.0
    • v2.41.0
    Affected ranges
    • ECOSYSTEM: ≥ 2.35.0, < 2.41.1

    Update to 2.41.1

Original sources

Check your server →