# CVE-2026-114407: e107 CMS reflected XSS in search author parameter

Source: https://junglewise.ai/threats/cve-2026-114407-e107-cms-before-2-3-13-contains-a-reflected-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114407 · Severity: medium · CVSS 6.1 · Published 2026-10-21

e107 is a content management system that powers websites. An attacker can craft a malicious link to the search page that injects JavaScript code, which runs in the browser of anyone who clicks it with administrative privileges—potentially allowing the attacker to install plugins and gain control of the entire website.

Technologies: [E107inc E107](https://junglewise.ai/threats/technologies/e107). Vendors: [E107inc](https://junglewise.ai/threats/vendors/e107inc).

## Quick answers

**Is CVE-2026-114407 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114407 being exploited in the wild.

**How severe is CVE-2026-114407?** Medium severity, with a CVSS score of 6.1, published 21 October 2026.

**Which products and versions are affected?** E107inc E107 2.2.0 through 2.3.12.

**Is there a fix for CVE-2026-114407?** Yes: fixed in 2.3.13. Until then: Until upgrading to 2.3.13, either remove the third argument from the userpicker() call in search.php line 474, or strip all query parameters whose names start with 'author' at the web server or proxy level (matching after URL-decoding, including bracketed names like author[...]). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114407 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-114407?** Check whether you run E107inc E107 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.3.13

Until upgrading to 2.3.13, either remove the third argument from the userpicker() call in search.php line 474, or strip all query parameters whose names start with 'author' at the web server or proxy level (matching after URL-decoding, including bracketed names like author[...]).

## Technical details

A reflected cross-site scripting vulnerability exists in search.php where the author GET parameter is passed unsafely to the userpicker() form handler's options argument. The options string is decoded with parse_str() and merged into the form field attributes; multiple option keys (tabindex, other, data-*) are rendered into the HTML output without proper escaping, allowing an attacker to break out of the input tag and inject arbitrary HTML and JavaScript via a crafted author parameter.

## Affected products

- e107inc e107 2.2.0 through 2.3.12

## Timeline

- 2026-10-21: disclosed

## References

- [https://github.com/e107inc/e107/releases/tag/v2.3.13](https://github.com/e107inc/e107/releases/tag/v2.3.13)
- [https://github.com/e107inc/e107/security/advisories/GHSA-g7rc-4jvq-27m9](https://github.com/e107inc/e107/security/advisories/GHSA-g7rc-4jvq-27m9)

## Related threats

- [e107 SQL injection in alt_auth authentication backends](https://junglewise.ai/threats/cve-2026-55572-e107-is-a-content-management-system-cms-prior-to-2-3-7-the)
- [e107 CMS remote code execution in e_array deserialization](https://junglewise.ai/threats/cve-2026-57859-e107-cms-remote-code-execution-in-e-array-deserialization)
- [e107 CMS command injection in ImageMagick resize destination path](https://junglewise.ai/threats/cve-2026-48997-e107-cms-command-injection-in-imagemagick-resize-destination-path)
- [e107 CMS CSRF in comment moderation endpoints](https://junglewise.ai/threats/cve-2026-46620-e107-cms-csrf-in-comment-moderation-endpoints)
- [e107 SSRF in Media Manager remote file fetcher](https://junglewise.ai/threats/cve-2026-43936-e107-ssrf-in-media-manager-remote-file-fetcher)