PT-2026-22341 · WordPress · Dato Cms Web Previews

Ayoub Benlamchich · Publicado 2026-02-27 · Atualizado 2026-02-27 · CVE-2026-3327

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Dato CMS Web Previews plugin versions prior to 1.0.31

Description A malicious authenticated user can bypass the configured frontend URL restriction, allowing arbitrary external resources or origins to be loaded. This is due to an authenticated iframe injection issue.

Recommendations Update to version 1.0.31 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-3327

Produtos afetados

Dato Cms Web Previews

Referências · 5

• https://github.com/datocms/plugins/commit/7965eebf0973cc5ebb18bc5ff9ce7ff19e89bb2e · Nota
• https://twitter.com/CVEnew/status/2027466606918701435 · Publicação no Twitter
• https://t.me/CVEtracker/45980 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-3327 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-3327 · Nota de Segurança