PT-2026-21807 · Unknown · Getsimplecms Community Edition

Vulncheck · Published 2026-02-24 · Updated 2026-02-25 · CVE-2026-26351

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GetSimpleCMS Community Edition version 3.3.16

Description GetSimpleCMS Community Edition version 3.3.16 has a stored cross-site scripting issue in the Theme to Components functionality within the components.php file. Input to the “slug” field of a component is stored without proper output encoding. The slug parameter is written to XML and rendered in the administrative interface without sanitation, allowing an authenticated administrator to inject malicious script content. This can lead to session hijacking, unauthorized administrative actions, and compromise of the CMS administrative interface when the Components page is viewed by any authenticated user.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-26351

GHSA-95F7-VM92-8GPX

Affected Products

Getsimplecms Community Edition

References · 12

• https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/releases/tag/v3.3.22 · Patch
• https://osv.dev/vulnerability/CVE-2026-26351 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26351 · Security Note
• https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-95f7-vm92-8gpx · Note
• https://t.me/CVEtracker/45665 · Telegram Post
• https://t.me/cveNotify/153153 · Telegram Post
• https://twitter.com/infoflowcloud/status/2026642460709945554 · Twitter Post
• https://t.me/cveNotify/153079 · Telegram Post
• https://twitter.com/CVEnew/status/2026641399932711196 · Twitter Post
• https://vulncheck.com/advisories/getsimplecms-ce-stored-xss-via-components-php · Note
• https://getsimple-ce.ovh · Note
• https://twitter.com/VulmonFeeds/status/2026443112604696881 · Twitter Post