CVE-2026-126498— WriteFreely before 0.17.3 Stored XSS via Unsanitized Post Slug
Quick assessment
Affected
Musing Studio WriteFreely
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WriteFreely 在 0.17.3 之前的版本中存在一个存储型跨站脚本（XSS）漏洞。已认证的作者可通过 CreatePost API 提交恶意的文章 slug（URL 标识符），从而注入 HTML 内容。对于包含付费短代码（paid-shortcode）的文章， 函数会将原始 slug 直接拼接到锚点中，导致脚本在 RSS/Atom 阅读器、邮件列表订阅者以及 ActivityPub 查看者中执行。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-126498
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WriteFreely before 0.17.3 Stored XSS via Unsanitized Post Slug
Source: CVE Program / CVE List V5
Vulnerability Description
WriteFreely before 0.17.3 contains a stored cross-site scripting vulnerability that allows authenticated authors to inject HTML by supplying a malicious post slug via the CreatePost API. The raw slug is concatenated into an anchor by augmentReadingDestination() for paid-shortcode posts, executing script for RSS/Atom feed readers, newsletter recipients and ActivityPub viewers.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Musing Studio | WriteFreely | 0 ~ 0.17.3 | - |
|
II. Public POCs for CVE-2026-126498
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-126498
请登录查看更多情报信息。
Other References for CVE-2026-126498 (6)
-
https://github.com/writefreely/writefreely/blob/v0.17.2/database.go#L702-L705 technical-description
-
https://github.com/writefreely/writefreely/blob/v0.17.2/postrender.go#L117-L121 technical-description
IV. Related Vulnerabilities
Same product: WriteFreely
Same vendor: Musing Studio
Same weakness: CWE-79
-
CVE-2026-126495
MQTTX through 1.13.3 Stored XSS via Topic Tree and JSON Tree -
CVE-2026-67177
Chargemap stored XSS -
CVE-2026-67175
Chargemap stored XSS -
CVE-2026-123259
Adobe Experience Manager | Cross-site Scripting (Stored XSS) -
CVE-2026-123258
Adobe Experience Manager | Cross-site Scripting (DOM-based X