Medium severity · published Jan 10, 2026
CVE-2026-22704
HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover
5.4
CVSS
1%
EPSS
No
On KEV
Description
HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IS
issues · haxtheweb
>= 11.0.6, < 25.0.0 · source: vendor
HA
Haxcms-nodejs · Psu
11.0.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22704
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22704
Patch
https://github.com/haxtheweb/haxcms-nodejs/commit/317a8ae29f88be389f7cfeffaef416957122d97e
Release Notes
https://github.com/haxtheweb/haxcms-nodejs/releases/tag/v25.0.0
Exploit
https://github.com/haxtheweb/issues/security/advisories/GHSA-3fm2-xfq7-7778
More from issues
9.9
CVE-2025-32028
HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution
9.8
CVE-2025-54127
HAXcms's Insecure Default Configuration Leads to Unauthenticated Access
8.8
CVE-2025-49141
HaxCMS-PHP Command Injection Vulnerability
8.3
CVE-2025-54378
HAX CMS Backend Lacks Comprehensive Authorization Checks
7.3
CVE-2025-54137
NodeJS version of the HAX CMS application is distributed with Default Secrets