CVE-2026-40353

CVE-2026-40353 is a stored cross-site scripting (XSS) vulnerability affecting wger, a free open-source fitness management application, in version 2.5 and below. The vulnerability exists in the AbstractLicenseModel's attribution_link property, which constructs HTML by directly interpolating unsanitized user-controlled license fields such as license_author without proper escaping. An authenticated attacker can inject malicious JavaScript code through the license_author field when creating an ingredient, and the vulnerability is rendered unsafe by Django's |safe filter, causing the payload to execute in the browsers of all visitors viewing the affected ingredient page. This is a stored XSS attack with moderate scope, requiring user authentication to exploit but affecting multiple users through persistent payload storage. The vulnerability has been fixed in version 2.5, and there is no evidence of active exploitation in the wild, with an EPSS score of 0.00017 and a FAUCET Risk Score of 32.0 indicating low current threat activity and community exploitation.