Is CVE-2026-109960 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109960 being exploited in the wild.

How severe is CVE-2026-109960?

High severity, with a CVSS score of 7.7, published 13 October 2026.

Is there a fix for CVE-2026-109960?

Yes: fixed in 2.3.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-109960 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-109960?

Check whether you run Froxlor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109960: Froxlor stored cross-site scripting in theme field

CVE-2026-109960 · Severity: high · CVSS 7.7 · Published 2026-10-13

Froxlor is a hosting control panel that manages customer accounts and server configurations. An authenticated customer can inject malicious JavaScript into their account's theme setting, which executes in an administrator's browser session when the administrator views the customer list with the Theme column displayed. This allows an attacker to abuse the administrator's session to create new admin accounts, modify server settings, or potentially compromise the entire server.

Technologies: Froxlor. Vendors: Froxlor.

Quick answers

Is CVE-2026-109960 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109960 being exploited in the wild.
How severe is CVE-2026-109960?: High severity, with a CVSS score of 7.7, published 13 October 2026.
Which products and versions are affected?: Froxlor 2.0.0 before 2.3.14.
Is there a fix for CVE-2026-109960?: Yes: fixed in 2.3.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109960 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-109960?: Check whether you run Froxlor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.3.14

Technical details

A stored cross-site scripting vulnerability exists in the customer theme field validation and rendering: the theme input is validated with a permissive pattern that allows HTML special characters (<, >, ") and is never constrained to installed themes, then rendered via Twig's {{|raw}} filter without escaping in the admin customer listing. An authenticated customer can inject an HTML/JavaScript payload via customer_index.php (send=changetheme), which persists and executes in the administrator's session when the admin views the customer overview with the Theme column enabled, provided the admin has explicitly enabled that column.

Affected products

Froxlor Froxlor 2.0.0 before 2.3.14

Timeline

2026-09-29: disclosed
2026-10-13: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.