# CVE-2026-46396: HAX CMS stored XSS in iframe elements

Source: https://junglewise.ai/threats/cve-2026-46396-hax-cms-stored-xss-in-iframe-elements  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-05. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-46396 · Severity: high · CVSS 4 · Published 2026-06-05

HAX CMS is a content management system used to build and manage microsites. A security flaw allows an attacker with basic posting privileges to embed malicious code into a page that executes when other users, including administrators, view it. This could lead to the theft of login tokens, session hijacking, and full account takeover, potentially compromising the entire website and its data.

Technologies: [Haxtheweb HAX CMS](https://junglewise.ai/threats/technologies/hax-cms), [Haxtheweb Haxcms-Nodejs](https://junglewise.ai/threats/technologies/haxcms-nodejs), [Haxtheweb Haxcms-Php](https://junglewise.ai/threats/technologies/haxcms-php), [@haxtheweb/haxcms-nodejs (npm)](https://junglewise.ai/threats/technologies/haxtheweb-haxcms-nodejs). Vendors: [Haxtheweb](https://junglewise.ai/threats/vendors/haxtheweb), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-46396 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46396 being exploited in the wild.

**How severe is CVE-2026-46396?** High severity, with a CVSS score of 4, published 5 June 2026.

**Which products and versions are affected?** Haxtheweb HAX CMS < 26.0.0; Haxtheweb Haxcms-Nodejs <= 25.0.0; Haxtheweb Haxcms-Php <= 25.0.0; Haxtheweb Iframe-Loader <= 25.0.0; and 4 more.

**Is there a fix for CVE-2026-46396?** Yes. @haxtheweb/haxcms-nodejs (npm): upgrade to 26.0.0 or later; @haxtheweb/iframe-loader (npm): upgrade to 26.0.0 or later; @haxtheweb/video-player (npm): upgrade to 26.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46396 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-46396?** Check whether you run Haxtheweb HAX CMS, Haxtheweb Haxcms-Nodejs, Haxtheweb Haxcms-Php or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @haxtheweb/haxcms-nodejs (npm): upgrade to 26.0.0 or later

  ```sh
  npm install @haxtheweb/haxcms-nodejs@26.0.0
  ```

- @haxtheweb/iframe-loader (npm): upgrade to 26.0.0 or later

  ```sh
  npm install @haxtheweb/iframe-loader@26.0.0
  ```

- @haxtheweb/video-player (npm): upgrade to 26.0.0 or later

  ```sh
  npm install @haxtheweb/video-player@26.0.0
  ```


## Technical details

A stored cross-site scripting (XSS) vulnerability exists in HAX CMS (PHP and Node.js versions) prior to 26.0.0. The root cause is improper sanitization of `<iframe>` elements, specifically allowing `javascript:` URIs and malicious `srcdoc` attributes. An authenticated attacker can inject a crafted iframe into a page; when viewed by others, the script executes in the context of the victim's browser. Because the application exposes sensitive data like JWTs in `window.appSettings`, an attacker can perform session hijacking or unauthorized API actions. The issue is fixed in version 26.0.0.

## Affected products

- haxtheweb HAX CMS < 26.0.0
- haxtheweb haxcms-nodejs <= 25.0.0
- haxtheweb haxcms-php <= 25.0.0
- haxtheweb iframe-loader <= 25.0.0
- haxtheweb video-player <= 25.0.0

## Identifiers

- CVE-2026-46396
- GHSA-jh3h-rpxg-fr36

## Timeline

- 2026-05-12: advisory: GitHub security advisory published
- 2026-06-05: disclosed: NVD publication date

## References

- [https://github.com/haxtheweb/issues/security/advisories/GHSA-jh3h-rpxg-fr36](https://github.com/haxtheweb/issues/security/advisories/GHSA-jh3h-rpxg-fr36)

## Related threats

- [haxtheweb HAX CMS weak PRNG for salts in install.php](https://junglewise.ai/threats/cve-2026-46493-haxtheweb-hax-cms-weak-prng-for-salts-in-install-php)
- [haxtheweb HAX CMS insufficient session expiration](https://junglewise.ai/threats/cve-2026-46401-haxtheweb-hax-cms-insufficient-session-expiration)
- [haxtheweb HAX CMS denial of service in createSite endpoint](https://junglewise.ai/threats/cve-2026-46357-haxtheweb-hax-cms-denial-of-service-in-createsite-endpoint)
- [HAX CMS account takeover via Stored XSS and token exposure](https://junglewise.ai/threats/cve-2026-46511-hax-cms-account-takeover-via-stored-xss-and-token-exposure)
- [haxtheweb HAX CMS stored XSS in video-player component](https://junglewise.ai/threats/cve-2026-46496-haxtheweb-hax-cms-stored-xss-in-video-player-component)