Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck

CVE-2026-119735Munshi XSS via Purchase Inquiry Thread Rendering

Medium 5.4

In plain English

A medium-severity cross-site scripting in Munshi from Petpooja. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 91.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread (/purchase-inquiry/thread/{thread-id}), which is assigned to innerHTML during rendering before text cleaning completes. Attackers can store a payload that executes in the browser of another user who opens the affected thread, achieving JavaScript execution and full-page defacement that re-triggers whenever the thread is reopened.

Affected products (as reported)

Vendor	Product	Versions
Petpooja	Munshi	0 – through 2026-07-13

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

Researcher Disclosure technical-description, exploit
Vender Homepage product
VulnCheck Advisory: Munshi XSS via Purchase Inquiry Thread Rendering third-party-advisory