Is CVE-2026-33386 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33386 being exploited in the wild.

How severe is CVE-2026-33386?

Informational severity, with a CVSS score of 0, published 29 May 2026.

Which products and versions are affected?

OpenSolution QuickCMS All versions up to 6.8 (prior to 2026-05-15 patch).

Is there a fix for CVE-2026-33386?

A patch was published on 2026-05-15: Patch for version 6.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33386 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-33386?

Check whether you run OpenSolution Quick.CMS. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33386: OpenSolution QuickCMS Cross-Site Scripting via insecure plugin fetching

CVE-2026-33386 · Severity: info · CVSS 0 · Published 2026-05-29

QuickCMS, a content management system used for building websites and online shops, contains a security flaw in how it fetches software plugins. Because the system uses an insecure connection to check for updates, an attacker positioned on the same network can intercept the request and inject malicious code. This could allow an attacker to take control of the administrator's browser session, potentially leading to unauthorized website changes or data theft.

Technologies: OpenSolution Quick.CMS. Vendors: OpenSolution.

Quick answers

Is CVE-2026-33386 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33386 being exploited in the wild.
How severe is CVE-2026-33386?: Informational severity, with a CVSS score of 0, published 29 May 2026.
Which products and versions are affected?: OpenSolution QuickCMS All versions up to 6.8 (prior to 2026-05-15 patch).
Is there a fix for CVE-2026-33386?: A patch was published on 2026-05-15: Patch for version 6.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33386 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-33386?: Check whether you run OpenSolution Quick.CMS. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

QuickCMS is vulnerable to a stored Cross-Site Scripting (XSS) attack stemming from an insecure update/plugin-fetching mechanism. The application communicates with the 'opensolution.org' server over unencrypted HTTP to retrieve plugin lists. A Man-in-the-Middle (MITM) attacker can intercept this traffic and serve a malicious HTML or JavaScript payload. When an administrator accesses the plugin management page within the CMS, the application fetches the remote content and renders it without proper sanitization, leading to the execution of arbitrary script in the context of the user's session. A patch was released on May 15, 2026, for version 6.8 to address this issue.

Affected products

OpenSolution QuickCMS All versions up to 6.8 (prior to 2026-05-15 patch)

Timeline

2026-05-15: patched: Patch for version 6.8 released
2026-05-29: advisory: Advisory published by CERT Polska

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.