Is CVE-2026-46396 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46396 being exploited in the wild.

How severe is CVE-2026-46396?

High severity, with a CVSS score of 4, published 5 June 2026.

Which products and versions are affected?

Haxtheweb HAX CMS < 26.0.0; Haxtheweb Haxcms-Nodejs <= 25.0.0; Haxtheweb Haxcms-Php <= 25.0.0; Haxtheweb Iframe-Loader <= 25.0.0; and 4 more.

Is there a fix for CVE-2026-46396?

Yes. @haxtheweb/haxcms-nodejs (npm): upgrade to 26.0.0 or later; @haxtheweb/iframe-loader (npm): upgrade to 26.0.0 or later; @haxtheweb/video-player (npm): upgrade to 26.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46396 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-46396?

Check whether you run Haxtheweb HAX CMS, Haxtheweb Haxcms-Nodejs, Haxtheweb Haxcms-Php or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46396: HAX CMS stored XSS in iframe elements

Q: Which products and versions are affected?

Haxtheweb HAX CMS < 26.0.0; Haxtheweb Haxcms-Nodejs <= 25.0.0; Haxtheweb Haxcms-Php <= 25.0.0; Haxtheweb Iframe-Loader <= 25.0.0; and 4 more.

Q: Is there a fix for CVE-2026-46396?

Yes. @haxtheweb/haxcms-nodejs (npm): upgrade to 26.0.0 or later; @haxtheweb/iframe-loader (npm): upgrade to 26.0.0 or later; @haxtheweb/video-player (npm): upgrade to 26.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-46396 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-46396?

Check whether you run Haxtheweb HAX CMS, Haxtheweb Haxcms-Nodejs, Haxtheweb Haxcms-Php or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46396 · Severity: high · CVSS 4 · Published 2026-06-05

HAX CMS is a content management system used to build and manage microsites. A security flaw allows an attacker with basic posting privileges to embed malicious code into a page that executes when other users, including administrators, view it. This could lead to the theft of login tokens, session hijacking, and full account takeover, potentially compromising the entire website and its data.

Technologies: Haxtheweb HAX CMS, Haxtheweb Haxcms-Nodejs, Haxtheweb Haxcms-Php, @haxtheweb/haxcms-nodejs (npm). Vendors: Haxtheweb, npm.

Quick answers

Is CVE-2026-46396 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46396 being exploited in the wild.
How severe is CVE-2026-46396?: High severity, with a CVSS score of 4, published 5 June 2026.
Which products and versions are affected?: Haxtheweb HAX CMS < 26.0.0; Haxtheweb Haxcms-Nodejs <= 25.0.0; Haxtheweb Haxcms-Php <= 25.0.0; Haxtheweb Iframe-Loader <= 25.0.0; and 4 more.
Is there a fix for CVE-2026-46396?: Yes. @haxtheweb/haxcms-nodejs (npm): upgrade to 26.0.0 or later; @haxtheweb/iframe-loader (npm): upgrade to 26.0.0 or later; @haxtheweb/video-player (npm): upgrade to 26.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46396 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46396?: Check whether you run Haxtheweb HAX CMS, Haxtheweb Haxcms-Nodejs, Haxtheweb Haxcms-Php or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@haxtheweb/haxcms-nodejs (npm): upgrade to 26.0.0 or later
```
npm install @haxtheweb/haxcms-nodejs@26.0.0
```
@haxtheweb/iframe-loader (npm): upgrade to 26.0.0 or later
```
npm install @haxtheweb/iframe-loader@26.0.0
```
@haxtheweb/video-player (npm): upgrade to 26.0.0 or later
```
npm install @haxtheweb/video-player@26.0.0
```

Technical details

A stored cross-site scripting (XSS) vulnerability exists in HAX CMS (PHP and Node.js versions) prior to 26.0.0. The root cause is improper sanitization of `<iframe>` elements, specifically allowing `javascript:` URIs and malicious `srcdoc` attributes. An authenticated attacker can inject a crafted iframe into a page; when viewed by others, the script executes in the context of the victim's browser. Because the application exposes sensitive data like JWTs in `window.appSettings`, an attacker can perform session hijacking or unauthorized API actions. The issue is fixed in version 26.0.0.

Affected products

haxtheweb HAX CMS < 26.0.0
haxtheweb haxcms-nodejs <= 25.0.0
haxtheweb haxcms-php <= 25.0.0
haxtheweb iframe-loader <= 25.0.0
haxtheweb video-player <= 25.0.0

Identifiers

CVE-2026-46396
GHSA-jh3h-rpxg-fr36

Timeline

2026-05-12: advisory: GitHub security advisory published
2026-06-05: disclosed: NVD publication date

References

https://github.com/haxtheweb/issues/security/advisories/GHSA-jh3h-rpxg-fr36

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.