Medium severity · published Apr 29, 2026
CVE-2026-40229
Helpy 2.8.0 - Stored XSS in post author display via PostsHelper
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Helpy contains a stored cross-site scripting vulnerability in the post author display logic. Any registered user can persist arbitrary HTML in their account name field and cause it to be rendered unescaped in public forum threads where they participate, in the admin ticket view, and in HTML notification emails sent to other users.This issue affects helpy: 2.8.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HE
helpy · helpyio
2.8.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40229
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-40229
Exploit
https://fluidattacks.com/es/advisories/offspring
Product
https://github.com/helpyio/helpy
More from helpy
5.4
CVE-2026-40230
Helpy 2.8.0 - Stored XSS in knowledgebase Doc body rendering