Skip to main content

This site requires you to update your browser. Your browsing experience maybe affected by not having the most up to date version.

SS-2026-005 XSS in required field label

SS-2026-005 XSS in required field label

Severity:
Medium (?)
Identifier:
SS-2026-005
Versions Affected:
silverstripe/userforms: < 7.1.4
Versions Fixed:
silverstripe/userforms: 7.1.4
Release Date:
2026-10-28

When a required field identifier is configured, the title of a user defined form field was rendered without escaping on the public form. A CMS author could use this to store content that runs JavaScript in the browser of a visitor.

Base CVSS: 4.4
Reported by: HDWSec - https://hdwsec.fr