---
id: "CVE-2026-112204"
page: "https://infrastack.ai/live/CVE-2026-112204"
kind: "vulnerability"
aliases: ["CVE-2026-112204"]
title: "WidzialniCMS: reflected XSS in index.php lets attackers run scripts in browsers"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "WidzialniCMS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cms", "other", "php", "widzialnicms"]
not_affected_if: ["version-2.5-or-later"]
published_at: "2026-11-09T13:17:04+00:00"
first_seen_at: "2026-11-09T13:26:50+00:00"
updated_at: "2026-11-09T13:27:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112204", "first_seen_at": "2026-11-09T13:26:50+00:00"}]
exploit_sources: []
---

# WidzialniCMS: reflected XSS in index.php lets attackers run scripts in browsers

Link for people: https://infrastack.ai/live/CVE-2026-112204 (this .md is for agents)

WidzialniCMS has a reflected cross-site scripting flaw in its /index.php endpoint. A victim who opens a crafted link runs attacker-chosen JavaScript in their browser, which can steal session cookies.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WidzialniCMS affected range not listed fixed no fixed version listed

## How to check

- Check the installed WidzialniCMS version against the fixed release `2.5`

## Fix

- WidzialniCMS: upgrade to `2.5`

## Timeline

- 2026-11-09T13:26:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112204

## From the sources

WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft.


This issue has been fixed in version 2.5.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_