PT-2026-22341 · WordPress · Dato Cms Web Previews

Ayoub Benlamchich · CVE-2026-3327 · Published 2026-02-27 · Updated 2026-02-27

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Dato CMS Web Previews plugin versions prior to 1.0.31

Description A malicious authenticated user can bypass the configured frontend URL restriction, allowing arbitrary external resources or origins to be loaded. This is due to an authenticated iframe injection issue.

Recommendations Update to version 1.0.31 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3327

Affected Products

Dato Cms Web Previews

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3327.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3327 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3327 · Vendor Advisory
• https://github.com/datocms/plugins/commit/7965eebf0973cc5ebb18bc5ff9ce7ff19e89bb2e · Note
• https://t.me/CVEtracker/45980 · Telegram Post
• https://twitter.com/CVEnew/status/2027466606918701435 · Twitter Post