# CVE-2026-29598: DDSN Interactive Acora CMS stored XSS in user management endpoints

Source: https://junglewise.ai/threats/cve-2026-29598-ddsn-interactive-acora-cms-stored-xss-in-user-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-01. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2026-29598 · Severity: medium · CVSS 5.4 · Published 2026-04-01

DDSN Interactive Acora CMS, a content management system used for website administration, contains a security flaw in its user management component. An attacker with basic user-creation privileges can inject malicious scripts into user profile fields like names. When other administrators view these profiles, the scripts execute, potentially allowing the attacker to hijack sessions, steal credentials, or perform unauthorized actions on the website.

Technologies: [DDSN Interactive Acora CMS](https://junglewise.ai/threats/technologies/acora-cms). Vendors: [DDSN Interactive](https://junglewise.ai/threats/vendors/ddsn-interactive).

## Quick answers

**Is CVE-2026-29598 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-29598 being exploited in the wild.

**How severe is CVE-2026-29598?** Medium severity, with a CVSS score of 5.4, published 1 April 2026.

**Which products and versions are affected?** DDSN Interactive Acora CMS 10.7.1.

**Is there a fix for CVE-2026-29598?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-29598 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-29598?** Check whether you run DDSN Interactive Acora CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Multiple stored cross-site scripting (XSS) vulnerabilities exist in the submit_add_user.asp and submit_edit_user.asp endpoints of DDSN Interactive Acora CMS v10.7.1. The vulnerability is caused by improper neutralization of input in the 'First Name' and 'Last Name' parameters. An attacker with low-level administrative privileges can inject a crafted JavaScript payload that is stored in the application's database. The payload executes in the browser of any user (typically higher-privileged administrators) who views the affected user records. This can lead to session hijacking, unauthorized data modification, or credential theft. A proof-of-concept has been disclosed, but official patch information is not currently detailed in the advisory.

## Affected products

- DDSN Interactive Acora CMS 10.7.1

## Timeline

- 2026-04-01: disclosed: Vulnerability disclosed by Joby Y Daniel from Crowe India
- 2026-04-01: advisory: NVD published CVE-2026-29598

## References

- [http://acora.com/](http://acora.com/)
- [https://github.com/padayali-JD/CVE-2026-29598](https://github.com/padayali-JD/CVE-2026-29598)

## Related threats

- [DDSN Interactive cm3 Acora CMS improper access control in file_details.asp](https://junglewise.ai/threats/cve-2026-29597-ddsn-interactive-cm3-acora-cms-improper-access-control-in-file)
- [DDSN Interactive Acora CMS static password reset token account takeover](https://junglewise.ai/threats/cve-2025-63314-ddsn-interactive-acora-cms-static-password-reset-token-account)