# CVE-2026-18957: Menulux Portal stored cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-18957-menulux-portal-stored-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-18957 · Severity: medium · CVSS 5.4 · Published 2026-09-04

Menulux Portal is a web-based application used for menu management and portal functionality. This vulnerability allows attackers to inject malicious JavaScript code that persists in the application and executes in users' browsers, potentially compromising user sessions, stealing credentials, or defacing content viewed by other portal users.

Technologies: [Menulux Software Inc. Menulux Portal](https://junglewise.ai/threats/technologies/menulux-portal). Vendors: [Menulux Software Inc.](https://junglewise.ai/threats/vendors/menulux-software-inc).

## Quick answers

**Is CVE-2026-18957 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18957 being exploited in the wild.

**How severe is CVE-2026-18957?** Medium severity, with a CVSS score of 5.4, published 4 September 2026.

**Which products and versions are affected?** Menulux Software Inc. Menulux Portal before 20260903211448.

**Is there a fix for CVE-2026-18957?** A patch was published on 2026-09-03: Version 20260903211448 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18957 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-18957?** Check whether you run Menulux Software Inc. Menulux Portal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored cross-site scripting (XSS) vulnerability arising from improper neutralization of user-supplied input during web page generation. The vulnerability exists in Menulux Portal before version 20260903211448. Attackers can inject malicious JavaScript through user-controlled input fields that are stored in the application and later rendered to other users without proper sanitization or encoding. No special authentication or network preconditions have been disclosed. A successful exploit allows arbitrary JavaScript execution in the context of affected users' browsers, enabling session hijacking, credential theft, or malware distribution. A patched version addressing this issue has been released.

## Affected products

- Menulux Software Inc. Menulux Portal before 20260903211448

## Timeline

- 2026-09-04: disclosed
- 2026-09-03: patched: Version 20260903211448 and later

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0989](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0989)

## Related threats

- [Menulux Portal observable response discrepancy allows account footprinting](https://junglewise.ai/threats/cve-2026-19080-menulux-portal-observable-response-discrepancy-allows-account)
- [Menulux Software Menulux Portal plaintext password storage](https://junglewise.ai/threats/cve-2026-19051-menulux-software-menulux-portal-plaintext-password-storage)
- [Menulux Portal missing authorization in access control](https://junglewise.ai/threats/cve-2026-19043-menulux-portal-missing-authorization-in-access-control)