Executive brief
Tendenci CMS, an open-source platform for managing non-profit organizations and associations, contains a security flaw in its Forums and Jobs modules. An attacker can post malicious content that, when viewed by other users or administrators, executes unauthorized scripts in their browsers. This could lead to the theft of login sessions, unauthorized access to sensitive member data, or the defacement of the organization's website.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Tendenci CMS (v16.14 and earlier) due to improper neutralization of user-controllable input before it is rendered in web pages. Specifically, the 'Subject' and 'Message' fields in the Forums module, as well as 'Job title' and other free-text fields in the Jobs module, fail to sanitize or encode input. An authenticated attacker with low privileges can inject malicious JavaScript payloads that are persistently stored in the database. These payloads execute automatically in the browser of any user—including administrators—who views the affected forum topic or job listing. This can result in session hijacking via cookie theft or unauthorized actions performed on behalf of the victim.
Affected products
- Tendenci Tendenci CMS <= 16.14
Timeline
- 2025-10-16: other: Vulnerability discovered by researcher
- 2026-02-02: disclosed: NVD publication date
- 2026-02-03: advisory: GitHub Advisory published