PT-2026-22341 · WordPress · Dato Cms Web Previews

Ayoub Benlamchich · Published 2026-02-27 · Updated 2026-02-27 · CVE-2026-3327

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Dato CMS Web Previews plugin versions prior to 1.0.31

Description A malicious authenticated user can bypass the configured frontend URL restriction, allowing arbitrary external resources or origins to be loaded. This is due to an authenticated iframe injection issue.

Recommendations Update to version 1.0.31 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3327

Affected Products

Dato Cms Web Previews

References · 5

• https://osv.dev/vulnerability/CVE-2026-3327 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3327 · Security Note
• https://github.com/datocms/plugins/commit/7965eebf0973cc5ebb18bc5ff9ce7ff19e89bb2e · Note
• https://twitter.com/CVEnew/status/2027466606918701435 · Twitter Post
• https://t.me/CVEtracker/45980 · Telegram Post