CVE-2026-11975 | Stored cross-site scripting (XSS) in NewsItemApiController I… | CVSS 6.2 MEDIUM

Description

Stored cross-site scripting (XSS) in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authenticated administrator to execute arbitrary JavaScript via the ShortContent and FullContent fields, which are stored without HTML sanitization and rendered unencoded via @Html.Raw()

Metadata

CVE ID: CVE-2026-11975
State: PUBLISHED
Assigner: Checkmarx
Reserved: 2026-06-11 11:55 UTC
Published: 2026-06-17 12:18 UTC
Last updated: 2026-06-17 15:03 UTC
Primary CWE: CWE-79
CWE-79 Improper neutralization of input during web page gene…
Vendor / Product: simplcommerce / SimplCommerce
Sources: cve.org · NVD

Severity & Metrics

6.2 MEDIUM CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
simplcommerce	SimplCommerce	—	0 < 6142d3b5

Weakness (CWE)

CWE	Source	Description
CWE-79	cna	CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.2	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N

References (2)