Medium severity · published Mar 27, 2026
CVE-2026-5010
Reflected Cross-Site Scripting (XSS) in Sanoma’s Clickedu
5.1
CVSS
0.3%
EPSS
No
On KEV
Description
A reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Clickedu. This vulnerability allows an attacker to execute JavaScript code in the victim’s browser by sending them a malicious URL using the endpoint “/user.php/”. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on the user’s behalf.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
Clickedu · Sanoma
before 5.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5010
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5010
www.incibe.es
https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-sanomas-clickedu-0
More from Clickedu
4.8
CVE-2025-41070
Reflected Cross-site Scripting (XSS) in Sanoma's Clickedu