CVE-2026-52307: Stored XSS in 1CMS v5.6

CVE-2026-52307 is an authenticated stored cross-site scripting (XSS) flaw in the Column Management component of ClassCMS 1CMS v5.6. An authenticated user can inject a crafted payload into the title field of a column, which is then stored and executed as arbitrary web scripts or HTML when other users view the affected content. Successful exploitation allows the attacker to run attacker-controlled scripts in the browsers of users who view the injected column, potentially enabling actions such as session hijacking or performing actions under victims' credentials. Only deployments of 1CMS v5.6 are identified as affected in the disclosure. There is no confirmed in-the-wild exploitation: the flaw is not in CISA KEV, EPSS estimates only a 0.3% probability of exploitation in the next 30 days, and one public proof-of-concept reference exists on GitHub.

Do: Audit whether you run 1CMS and confirm the version; operators of v5.6 should restrict which authenticated accounts can edit column titles and sanitize/validate title input as an interim mitigation. Watch the vendor and the referenced PoC (github.com/linan-OO/CVE-2026-52307) for a patched release, and upgrade as soon as a fixed version is published, since no fixed version is specified in the current disclosure. Given the low EPSS score, absence from CISA KEV, and the authentication requirement, treat this as a lower-priority patch pending vendor guidance.