Medium severity · published Apr 17, 2026
CVE-2026-40353
wger: Stored XSS via Unescaped License Attribution Fields
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the attribution_link property in AbstractLicenseModel constructs HTML by directly interpolating user-controlled license fields (such as license_author) without escaping, and templates render the result using Django's |safe filter. An authenticated user can create an ingredient with a malicious license_author value containing JavaScript, which executes in the browser of any visitor viewing the ingredient page, resulting in stored XSS. This issue has been fixed in version 2.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WG
wger · wger-project
< 2.5 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40353
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-40353
Release Notes
https://github.com/wger-project/wger/releases/tag/2.5
Exploit
https://github.com/wger-project/wger/security/advisories/GHSA-6f54-qjvm-wwq3
More from wger
9.9
CVE-2026-43948
wger: cross-tenant password reset and plaintext disclosure via gym=None bypass
8.1
CVE-2026-43978
wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers
7.6
CVE-2026-40474
wger has Broken Access Control in the Global Gym Configuration Update Endpoint
7.5
CVE-2026-43977
wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API
7.1
CVE-2026-46434
wger: Trainer Privilege Escalation - Improper Privilege Management