CVE-2026-47348 is a Cross-Site Scripting vulnerability in TYPO3 CMS affecting versions 13.0.0-13.4.30 and 14.0.0-14.3.2. The issue arises because page titles created or modified by editors can include HTML markup that is stored in the search index without sanitization. When these titles are rendered in frontend search results via the Indexed Search plugin, they are not properly encoded, allowing malicious scripts to execute in users' browsers. This vulnerability requires editor-level privileges to exploit and involves improper neutralization of input during web page generation (CWE-79).

An attacker with editor access can inject malicious HTML or script code into page titles, which are then stored and displayed in frontend search results without proper encoding. This can lead to Cross-Site Scripting attacks affecting users who view the search results, potentially resulting in session hijacking, defacement, or other client-side impacts. The vulnerability has a CVSS 4.0 score of 5.1 (medium severity), indicating a moderate risk with network attack vector and low complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict editor permissions to trusted users only and consider disabling or limiting the use of the Indexed Search plugin for frontend search results. Monitor TYPO3 vendor advisories for updates and apply official patches once available.