Live › vulnerability › CVE-2026-115606
Go to dashboardCrowd Favorite DXP ToolKit (dxp-toolkit) through version 2.0.1 fails to neutralize input when it generates web pages, enabling stored cross-site scripting. An attacker who can store content in the toolkit can run JavaScript in the browsers of users who view that content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.
Sites or applications that run Crowd Favorite DXP ToolKit through version 2.0.1 and accept user-supplied content that is later displayed to other users. The sources do not state which configurations or roles are required, so exposure beyond the affected version range is unknown.
No product ranges from the sources yet.
2.0.1)2.0.1 once a fixed release is confirmedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows Stored XSS.This issue affects DXP ToolKit: from n/a through 2.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-115606")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.