CVE-2026-35569

OVERVIEW: CVE-2026-35569 is a stored cross-site scripting vulnerability in ApostropheCMS versions 4.28.0 and earlier that affects SEO-related fields including SEO Title and Meta Description. User-controlled input is rendered without proper output encoding in HTML contexts such as title tags, meta attributes, and JSON-LD structured data, allowing attackers to inject malicious JavaScript payloads. SEVERITY: The vulnerability requires network access and low privilege level (authenticated user) to exploit but results in high impact. The CVSS 3.1 score is 8.7 (HIGH) with a network attack vector and low complexity. Successful exploitation enables arbitrary JavaScript execution in victim browsers, potentially leading to authenticated API requests, exfiltration of sensitive data including usernames, email addresses, and user roles, and unauthorized access to internal APIs. EXPLOITATION STATUS: The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog and has low EPSS probability of exploitation at 0.00034. No public exploit code appears to be actively circulating in the threat community. ApostropheCMS has addressed the issue in version 4.29.0, and organizations running affected versions should prioritize updating to remediate this stored XSS vulnerability.