Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresenter.php, which inserts the… (CVE-2026-109328)

The vulnerability in Admidio 5.0.0 before 5.0.15 is an unauthenticated stored cross-site scripting issue in RegistrationPresenter.php. It arises from inserting the raw FIRST_NAME registration value into an unencoded data-message attribute, allowing attackers to inject JavaScript via a double-quoted event handler. This script executes in the context of an administrator's session upon hovering over the malicious entry on the Manage registrations page.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator's session, potentially leading to session hijacking or other client-side attacks. The CVSS score of 6.1 (medium severity) reflects the network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact without availability impact.

A fix is available in Admidio version 5.0.15. Users should upgrade to version 5.0.15 or later to remediate this vulnerability. Since the vulnerability is unauthenticated and involves stored XSS, patching is the primary recommended mitigation.