CVE-2026-31953: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in xibosignage xibo-cms
A stored Cross-Site Scripting (XSS) vulnerability exists in xibo-cms versions prior to 4. 4. 1. An authenticated user with notification creation permissions can inject arbitrary JavaScript into notification bodies. When such a notification is set as an "interrupt," the script executes automatically in the browser of any targeted user upon login without requiring user interaction. This vulnerability requires privileges that are not granted to non-admin users by default. The issue is fixed in version 4. 4. 1.
AI Analysis
Technical Summary
CVE-2026-31953 is a stored XSS vulnerability in the xibo-cms component of the xibosignage platform. It affects versions before 4.4.1 and allows an authenticated user with notification creation privileges to inject malicious JavaScript into notifications. These notifications, when configured as interrupts, execute the payload automatically in the browsers of users who view them upon login. The vulnerability requires specific privileges related to notification creation and access, which are typically restricted to admin-level users. The vulnerability is addressed by upgrading to version 4.4.1.
Potential Impact
Successful exploitation allows an attacker with notification creation permissions to execute arbitrary JavaScript in the context of other users' browsers without their interaction. This can lead to information disclosure and integrity impacts within the affected application session. The vulnerability does not affect availability. The attack surface is limited to authenticated users with elevated privileges, reducing the risk to general users.
Mitigation Recommendations
Upgrade xibo-cms to version 4.4.1 or later, which fixes this vulnerability. If upgrading is not immediately possible, restrict notification creation and notification center access privileges to trusted users only, as these privileges are required to exploit the vulnerability. No other vendor advisory or patch information is available, so check the vendor's official resources for updates.
CVE-2026-31953: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in xibosignage xibo-cms
Description
A stored Cross-Site Scripting (XSS) vulnerability exists in xibo-cms versions prior to 4. 4. 1. An authenticated user with notification creation permissions can inject arbitrary JavaScript into notification bodies. When such a notification is set as an "interrupt," the script executes automatically in the browser of any targeted user upon login without requiring user interaction. This vulnerability requires privileges that are not granted to non-admin users by default. The issue is fixed in version 4. 4. 1.
CVSS v3.1
Score 6.4medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-31953 is a stored XSS vulnerability in the xibo-cms component of the xibosignage platform. It affects versions before 4.4.1 and allows an authenticated user with notification creation privileges to inject malicious JavaScript into notifications. These notifications, when configured as interrupts, execute the payload automatically in the browsers of users who view them upon login. The vulnerability requires specific privileges related to notification creation and access, which are typically restricted to admin-level users. The vulnerability is addressed by upgrading to version 4.4.1.
Potential Impact
Successful exploitation allows an attacker with notification creation permissions to execute arbitrary JavaScript in the context of other users' browsers without their interaction. This can lead to information disclosure and integrity impacts within the affected application session. The vulnerability does not affect availability. The attack surface is limited to authenticated users with elevated privileges, reducing the risk to general users.
Mitigation Recommendations
Upgrade xibo-cms to version 4.4.1 or later, which fixes this vulnerability. If upgrading is not immediately possible, restrict notification creation and notification center access privileges to trusted users only, as these privileges are required to exploit the vulnerability. No other vendor advisory or patch information is available, so check the vendor's official resources for updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-10T15:10:10.657Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69eac1fc87115cfb688c86dc
Added to database: 4/24/2026, 1:06:04 AM
Last enriched: 5/1/2026, 8:43:14 PM
Last updated: 6/7/2026, 8:27:27 AM
Views: 54
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.