CVE-2026-33386

Vulnerability

Cross-Site Scripting (XSS) exists in QuickCMS through the insecure HTTP-based plugin-fetching mechanism. A malicious attacker can perform a Man-in-the-Middle (MITM) attack by impersonating the opensolution.org server and serving arbitrary HTML or JavaScript at the plugin list endpoint. All versions up to and including version 6.8 (before the patch of 15 May 2026) are affected [1].

Exploitation

An attacker must have a network position that allows them to intercept or redirect HTTP traffic between a QuickCMS instance and the plugin server at opensolution.org. By impersonating that server, the attacker injects malicious content that is automatically fetched and rendered when the victim accesses the plugin page. No authentication or user interaction beyond visiting the plugin page is required [1].

Impact

Successful exploitation results in arbitrary HTML or JavaScript execution in the context of the victim's browser session. This can lead to information disclosure, session hijacking, or other client-side attacks. The privilege level obtained is that of the victim user viewing the plugin page [1].

Mitigation

The vulnerability was fixed in a patch to version 6.8 published on 2026-05-15. Deployments running version 6.8 (or earlier) must apply the patch immediately. No workaround is described in the available references; upgrading to the patched version is the recommended action [1].