Is CVE-2026-10153 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10153 being exploited in the wild.

How severe is CVE-2026-10153?

Medium severity, with a CVSS score of 4.3, published 30 May 2026.

Which products and versions are affected?

Westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab.

Is there a fix for CVE-2026-10153?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10153 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-10153?

Check whether you run Westboy CicadasCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10153: westboy CicadasCMS reflected XSS in search function

CVE-2026-10153 · Severity: medium · CVSS 4.3 · Published 2026-05-30

CicadasCMS, a content management system, contains a security flaw in its search functionality. An attacker can trick a logged-in administrator into clicking a malicious link, which allows the attacker to execute unauthorized commands in the administrator's browser. In practice, this can be used to silently create new administrator accounts, leading to a full takeover of the website and its data.

Technologies: Westboy CicadasCMS. Vendors: Westboy.

Quick answers

Is CVE-2026-10153 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10153 being exploited in the wild.
How severe is CVE-2026-10153?: Medium severity, with a CVSS score of 4.3, published 30 May 2026.
Which products and versions are affected?: Westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab.
Is there a fix for CVE-2026-10153?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10153 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-10153?: Check whether you run Westboy CicadasCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the 's' parameter of the /search interface in CicadasCMS. The application fails to sanitize input or validate data types for this parameter, reflecting malicious scripts back to the user's browser. This vulnerability can be chained with a lack of Anti-CSRF tokens in the /system/user/update endpoint. By inducing an authenticated administrator to visit a crafted URL, an attacker can bypass the Same-Origin Policy (SOP) and perform sensitive actions, such as creating a new administrator account. The issue was identified in version 1.0 (commit 2431154) and remains unpatched as of the advisory date.

Affected products

westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab

Timeline

2026-05-04: disclosed: Issue reported to the project maintainer via Gitee
2026-05-30: advisory: Vulnerability published to NVD/VulDB

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.