Medium severity · published Feb 3, 2026
CVE-2026-1592
Stored XSS via Create New Layer Field found in Foxit PDF Editor Cloud
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the Create New Layer feature. Unsanitized user input is embedded into the HTML output, allowing arbitrary JavaScript execution when the layer is referenced.
This issue affects pdfonline.foxit.com: before 2026‑02‑03.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PD
pdfonline.foxit.com · Foxit Software Inc.
before 2026‑02‑03 · source: vendor
PE
Pdf Editor Cloud · Foxit
before 2026-02-03 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1592
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1592
Vendor Advisory
https://www.foxit.com/support/security-bulletins.html
More from pdfonline.foxit.com
5.4
CVE-2026-1591
Stored XSS via Attachments Feature in https://pdfonline.foxit.com/
5.4
CVE-2025-66522
Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Digital IDs Common Name Field
5.4
CVE-2025-66521
Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Trusted Certificates Feature
5.4
CVE-2025-66520
Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Portfolio SVG Handling
5.4
CVE-2025-66519
Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Layer Import Functionality