---
id: "CVE-2026-11959"
kind: "vulnerability"
aliases: ["CVE-2026-11959"]
title: "FacturaScripts: stored XSS in warehouse city and province fields"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["facturascripts", "package", "php", "self-hosted"]
not_affected_if: ["single-user-instance"]
published_at: "2026-10-20T09:17:09+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T03:40:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11959", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# FacturaScripts: stored XSS in warehouse city and province fields

FacturaScripts 2025.61 does not validate or sanitise the 'city' and 'province' fields on the ListAlmacen endpoint, so input stored there runs as JavaScript in other users' browsers. An attacker can use this to hijack sessions and, per the advisory, escalate from a normal user to administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FacturaScripts version in the application's about or package metadata; 2025.61 is affected per the sources
- Confirm whether users other than administrators can edit warehouse (almacen) city and province fields
- unknown

## Fix

- Upgrade FacturaScripts beyond `2025.61`; the sources do not name a fixed version
- unknown

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-11959

## From the sources

Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser (the application user) or to escalate privileges from a normal user to an administrator by executing specially crafted JavaScript code, thereby compromising the system’s confidentiality or hijacking the session (even with httpOnly cookies by extracting CSRF tokens).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_