CVE-2026-6633 is a reflected cross-site scripting (XSS) vulnerability discovered in Yifang CMS versions up to 2.0.5, specifically within the Extended Management Module's admin account function located in plugins/yifang_backend_account/logic/admin/L_rbac_admin.php. An attacker can manipulate the Account parameter to inject malicious scripts that execute in a victim's browser. The vulnerability is rated CVSS 3.5 (Low) and requires network access with low attack complexity, but necessitates user interaction and authenticated access (PR:L). The impact is limited to integrity violations with no confidentiality or availability risk. The EPSS score of 0.0001 indicates minimal prevalence relative to all known CVEs. Exploitation status indicates active concern despite low severity metrics. Public exploit code has been released and the vulnerability is tracked on the CISA Known Exploited Vulnerabilities (KEV) Active list, elevating monitoring priority. The vendor has been unresponsive to early disclosure, leaving affected organizations without an official patch and requiring compensating controls or system upgrades.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Yifang | CMS | 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5CNA affected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.2 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.