Vulnerability · Published Oct 20, 2026 · Assigned by TYPO3
CVE-2026-113442Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
Medium 5.3
In plain English
A medium-severity cross-site scripting in Extension "TYPO3 Fluid-Form by coding.ms" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 4.0)5.3Medium
Exploit odds (30 days)0.5%top 60.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TYPO3 | Extension "TYPO3 Fluid-Form by coding.ms" | 6.0.0 – before 6.0.60 – before 5.0.10 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://typo3.org/security/advisory/typo3-ext-sa-2026-033 vendor-advisory