VULNERABILITY INTELLIGENCE
CVE-2026-44401
CVSS score4.8 MEDIUM
EPSS probability0.32%
CISA KEVNot currently listed
Published2026-08-10
Last modified2026-09-10
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Description
Typemill CMS version 2.x contains a persistent cross-site scripting vulnerability in the Markdown parser extension that allows authenticated users with theme-configuration access to inject malicious JavaScript URIs by supplying unsanitized href values in Markdown links. Attackers can craft Markdown links using the javascript: scheme through ParsedownExtension.php or TwigMarkdownExtension.php, storing a persistent payload that executes in the browser of every visitor who clicks the link, enabling session cookie theft, authenticated request forgery, and credential harvesting.
Weakness classification
- disclosure@vulncheck.com: CWE-79