CVE-2026-71542

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting (XSS) in the "Theme to Components" functionality (admin/components.php) via the title parameter. The stored title is rendered inside a double-quoted HTML attribute in the administrative interface through an output path that HTML-entity-decodes the value before printing it, without re-encoding for the attribute context. This allows persistent execution of arbitrary JavaScript in the admin panel. At time of publication, there are no publicly available patches.

• CWE-79

• https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-vqfh-838q-xfqh
• https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-vqfh-838q-xfqh

Published

Oct 1, 2026

Last Modified

Oct 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7153A security flaw has been discovered in Totolink A8000RU 7.1c…9.8
• CVE-2026-71537Paymenter is a free and open-source webshop solution for man…6.5
• CVE-2026-71538@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of …8.5
• CVE-2026-71539n8n is an open source workflow automation platform. Prior to…8.9
• CVE-2026-7154A weakness has been identified in Totolink A8000RU 7.1cu.643…9.8
• CVE-2026-71540Wazuh is an open-source security platform providing unified …7.5
• CVE-2026-71543OpenBao is an open source identity-based secrets management …7.5
• CVE-2026-7155A security vulnerability has been detected in Totolink A8000…9.8
• CVE-2026-71551Super Productivity is an advanced todo list app with integra…7.8
• CVE-2026-71553ApostropheCMS is an open-source Node.js content management s…7.1
• CVE-2026-71554h2 is a pure-Python implementation of a HTTP/2 protocol stac…5.3
• CVE-2026-71555PILOS (Platform for Interactive Live-Online Seminars) is a f…4.1