CVE-2026-91999: Apache Sling XSS: Improper escaping in the XSS Webconsole plugin
Apache Sling XSS before 2.4.12 contains a low-severity cross-site scripting flaw, CVE-2026-91999.
Apache disclosed CVE-2026-91999, a cross-site scripting flaw from improper input neutralization in the Apache Sling XSS Webconsole plugin. Versions before 2.4.12 are affected, and users are advised to upgrade to 2.4.12. Apache rates the issue low and tracks it as SLING-13335. The advisory does not say the flaw is being exploited.
- Improper escaping in the XSS Webconsole plugin allows cross-site scripting.
- Apache Sling XSS before 2.4.12 is affected; 2.4.12 fixes it.
- Apache rates severity low and tracks the bug as SLING-13335.
- The advisory does not report active exploitation.
- CVEs
- CVE-2026-91999
- Vendors
- Apache Software Foundation
- Products
- Apache Sling XSS
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91999 | Cross-Site Scripting in Apache Sling XSS Webconsole Plugin (pre-2.4.12) | 6.1 | — |
From the original article
Posted by Joerg Hoh on Sep 23 Severity: low Affected versions: - Apache Sling XSS before 2. 4. 12 Description: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.