CVE-2026-91999: Apache Sling XSS: Improper escaping in the XSS Webconsole plugin

Apache Sling XSS before 2.4.12 contains a cross-site scripting flaw (CWE-79) caused by improper neutralization of input during web page generation, reported as improper escaping in the XSS Webconsole plugin. An attacker crafts a request whose payload is reflected unescaped into the plugin's generated web console page, and the malicious script executes when a victim is tricked into viewing that page (user interaction required, no privileges needed). Successful exploitation lets the attacker run script in the victim's browser in the context of the Sling console, yielding limited confidentiality and integrity impact such as session or token theft and actions performed as the victim, with no availability impact. Any deployment using Apache Sling XSS versions before 2.4.12 is affected; users are advised to upgrade to 2.4.12. There is no known public proof of concept, the issue is not in CISA's KEV catalog, and no exploitation has been observed.