Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck

CVE-2026-120488LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content

Medium 5.4

In plain English

A medium-severity cross-site scripting in LaraDashboard from LaraDashboard. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 87.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with post.create or post.edit permission to inject scripts via unsanitized LaraBuilder design_json block content. Attackers can save text-editor, HTML, text or heading blocks containing script or event-handler markup that executes in administrator or Superadmin sessions viewing the builder, preview or page.

Affected products (as reported)

Vendor	Product	Versions
LaraDashboard	LaraDashboard	0 – before 1.4.9

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-w878-x2w9-3r6f) vendor-advisory
GitHub Security Advisory (GHSA-rf5h-55h2-jmf8) vendor-advisory
GitHub Security Advisory (GHSA-9gg9-jh9p-fw37) vendor-advisory
https://github.com/laradashboard/laradashboard/commit/5955d725683b1e63af8c38a149211d6151465aed patch
LaraDashboard v1.4.9 Release Notes release-notes
https://github.com/laradashboard/laradashboard/blob/v1.4.8/resources/js/lara-builder/blocks/text-editor/render.php#L99-L104 technical-description
VulnCheck Advisory: LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content third-party-advisory