Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck

CVE-2026-109960Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value

High 7.7

In plain English

A high-severity cross-site scripting in froxlor from froxlor. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.3%top 78.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings.

Affected products (as reported)

Vendor	Product	Versions
froxlor	froxlor	2.0.0 – before 2.3.14

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-3jpp-mhvh-rv66) vendor-advisory
VulnCheck Advisory: Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value third-party-advisory