CVE-2026-21483

CVE-2026-21483 is a stored Cross-Site Scripting (XSS) vulnerability affecting nadh listmonk versions prior to 6.0.0. A lower-privileged user with campaign management permissions can inject malicious JavaScript into campaigns or templates. When a Super Admin views or previews this content, the XSS executes, potentially allowing the attacker to perform privileged actions like creating backdoor admin accounts, with the attack weaponizable via the public archive feature. This medium-severity vulnerability (CVSS 5.4) has a low attack complexity and requires user interaction, but can lead to limited confidentiality and integrity impacts. There is currently no evidence of active exploitation, public exploit code, or significant community discussion.