Medium severity · published Sep 11, 2026
CVE-2026-89145
Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory
4.2
CVSS
0.2%
EPSS
No
On KEV
Description
Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts in users' browsers when dependency validation fails.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
flextype · flextype
0.9.9 through 1.0.0-alpha.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89145
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-89145
github.com
https://github.com/flextype/flextype
github.com
https://github.com/flextype/flextype/blob/aea4ead8c449ea5517ed53b6dcbd28b0a528ad9d/src/flextype/core/Plugins.php#L345
github.com
https://github.com/flextype/flextype/issues/597
www.vulncheck.com
https://www.vulncheck.com/advisories/flextype-cms-0.9.9-through-1.0.0-alpha.3-stored-xss-via-plugin-directory
More from flextype
8.3
CVE-2026-91751
Flextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST API
6.5
CVE-2026-77939
Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint
5.9
CVE-2026-88897
Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String