High severity · published Oct 13, 2026
CVE-2026-109960
Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value
7.7
CVSS
0.3%
EPSS
No
On KEV
Description
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
froxlor · froxlor
2.0.0 before 2.3.14 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109960
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109960
vendor-advisory
https://github.com/froxlor/froxlor/security/advisories/GHSA-3jpp-mhvh-rv66
third-party-advisory
https://www.vulncheck.com/advisories/froxlor-2.0.0-before-2.3.14-stored-xss-via-customer-theme-value
More from froxlor
9.9
CVE-2026-113678
Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron
9.9
CVE-2026-100717
froxlor before 2.3.12 CRLF Injection via validateUrl userinfo
9.9
CVE-2026-100716
Froxlor before 2.3.12 Privilege Escalation via Symlink
9.9
CVE-2026-90937
froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL
9.9
CVE-2026-41228
Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution