Vulnerability · Published Aug 10, 2026 · Assigned by VulnCheck

CVE-2026-44401Typemill CMS 2.x Persistent XSS via Markdown javascript URI

Medium 4.8

In plain English

A medium-severity cross-site scripting in Typemill from Typemill. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.3%top 74.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Typemill CMS version 2.x contains a persistent cross-site scripting vulnerability in the Markdown parser extension that allows authenticated users with theme-configuration access to inject malicious JavaScript URIs by supplying unsanitized href values in Markdown links. Attackers can craft Markdown links using the javascript: scheme through ParsedownExtension.php or TwigMarkdownExtension.php, storing a persistent payload that executes in the browser of every visitor who clicks the link, enabling session cookie theft, authenticated request forgery, and credential harvesting.

Affected products (as reported)

Vendor	Product	Versions
Typemill	Typemill	2.0.0 – through 2.23.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

References

Product Repository product
Fixed Release patch
https://www.vulncheck.com/advisories/typemill-cms-2-x-persistent-xss-via-markdown-javascript-uri third-party-advisory
PoC technical-description