Is CVE-2026-114407 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114407 being exploited in the wild.

How severe is CVE-2026-114407?

Medium severity, with a CVSS score of 6.1, published 21 October 2026.

Which products and versions are affected?

E107inc E107 2.2.0 through 2.3.12.

How is CVE-2026-114407 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-114407?

Check whether you run E107inc E107 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114407: e107 CMS reflected XSS in search author parameter

CVE-2026-114407 · Severity: medium · CVSS 6.1 · Published 2026-10-21

e107 is a content management system that powers websites. An attacker can craft a malicious link to the search page that injects JavaScript code, which runs in the browser of anyone who clicks it with administrative privileges—potentially allowing the attacker to install plugins and gain control of the entire website.

Technologies: E107inc E107. Vendors: E107inc.

Quick answers

Is CVE-2026-114407 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114407 being exploited in the wild.
How severe is CVE-2026-114407?: Medium severity, with a CVSS score of 6.1, published 21 October 2026.
Which products and versions are affected?: E107inc E107 2.2.0 through 2.3.12.
Is there a fix for CVE-2026-114407?: Yes: fixed in 2.3.13. Until then: Until upgrading to 2.3.13, either remove the third argument from the userpicker() call in search.php line 474, or strip all query parameters whose names start with 'author' at the web server or proxy level (matching after URL-decoding, including bracketed names like author[...]). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114407 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-114407?: Check whether you run E107inc E107 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.3.13

Until upgrading to 2.3.13, either remove the third argument from the userpicker() call in search.php line 474, or strip all query parameters whose names start with 'author' at the web server or proxy level (matching after URL-decoding, including bracketed names like author[...]).

Technical details

A reflected cross-site scripting vulnerability exists in search.php where the author GET parameter is passed unsafely to the userpicker() form handler's options argument. The options string is decoded with parse_str() and merged into the form field attributes; multiple option keys (tabindex, other, data-*) are rendered into the HTML output without proper escaping, allowing an attacker to break out of the input tag and inject arbitrary HTML and JavaScript via a crafted author parameter.

Affected products

e107inc e107 2.2.0 through 2.3.12

Timeline

2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.