CVE-2026-40282

CVE-2026-40282 is a Stored Cross-Site Scripting (XSS) vulnerability affecting WeGIA, a web management platform for charitable institutions, in versions prior to 3.6.10. An authenticated user can inject malicious JavaScript into the Intercorrências notification page, which executes when other users access the page, potentially enabling session hijacking and account takeover. The vulnerability has been patched in version 3.6.10. The attack requires user authentication to exploit, indicating moderate complexity, though the stored nature of the payload means it affects multiple users without requiring individual re-exploitation. The FAUCET Risk Score of 35.0/100 reflects a moderate threat level. While specific CVSS metrics are unavailable, the vulnerability's impact includes unauthorized account access and session compromise. The vulnerability is not currently tracked on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on industry hot lists, suggesting limited active exploitation in the wild. Community attention appears minimal, and no public exploit code has been widely disseminated. Organizations running WeGIA should prioritize updating to version 3.6.10 to mitigate this risk.