# CVE-2026-109960: Froxlor stored cross-site scripting in theme field

Source: https://junglewise.ai/threats/cve-2026-109960-froxlor-2-0-0-before-2-3-14-contains-a-stored-cross-site  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109960 · Severity: high · CVSS 7.7 · Published 2026-10-13

Froxlor is a hosting control panel that manages customer accounts and server configurations. An authenticated customer can inject malicious JavaScript into their account's theme setting, which executes in an administrator's browser session when the administrator views the customer list with the Theme column displayed. This allows an attacker to abuse the administrator's session to create new admin accounts, modify server settings, or potentially compromise the entire server.

Technologies: [Froxlor](https://junglewise.ai/threats/technologies/froxlor). Vendors: [Froxlor](https://junglewise.ai/threats/vendors/froxlor).

## Quick answers

**Is CVE-2026-109960 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109960 being exploited in the wild.

**How severe is CVE-2026-109960?** High severity, with a CVSS score of 7.7, published 13 October 2026.

**Which products and versions are affected?** Froxlor 2.0.0 before 2.3.14.

**Is there a fix for CVE-2026-109960?** Yes: fixed in 2.3.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109960 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-109960?** Check whether you run Froxlor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.3.14

## Technical details

A stored cross-site scripting vulnerability exists in the customer theme field validation and rendering: the theme input is validated with a permissive pattern that allows HTML special characters (<, >, ") and is never constrained to installed themes, then rendered via Twig's {{|raw}} filter without escaping in the admin customer listing. An authenticated customer can inject an HTML/JavaScript payload via customer_index.php (send=changetheme), which persists and executes in the administrator's session when the admin views the customer overview with the Theme column enabled, provided the admin has explicitly enabled that column.

## Affected products

- Froxlor Froxlor 2.0.0 before 2.3.14

## Timeline

- 2026-09-29: disclosed
- 2026-10-13: advisory

## References

- [https://github.com/froxlor/froxlor/security/advisories/GHSA-3jpp-mhvh-rv66](https://github.com/froxlor/froxlor/security/advisories/GHSA-3jpp-mhvh-rv66)
- [https://www.vulncheck.com/advisories/froxlor-2.0.0-before-2.3.14-stored-xss-via-customer-theme-value](https://www.vulncheck.com/advisories/froxlor-2.0.0-before-2.3.14-stored-xss-via-customer-theme-value)

## Related threats

- [Froxlor information disclosure in API keys listing](https://junglewise.ai/threats/cve-2026-121436-froxlor-from-2-3-8-before-2-3-15-contains-an-information)
- [Froxlor authorization bypass in Mysqls.add API](https://junglewise.ai/threats/cve-2026-121435-froxlor-before-2-3-15-contains-an-authorization-bypass)
- [Froxlor Certificates API authorization bypass in Let's Encrypt management](https://junglewise.ai/threats/cve-2026-121434-froxlor-2-3-0-before-2-3-15-contains-a-missing-authorization)
- [Froxlor symlink following in Statistics::makeChownWithNewStats](https://junglewise.ai/threats/cve-2026-113678-froxlor-before-2-3-15-contains-a-symlink-following-vulnerability)
- [Froxlor missing authorization in SubDomains.delete API](https://junglewise.ai/threats/cve-2026-113677-froxlor-from-0-10-0-before-2-3-15-contains-a-missing)