Vulnerability · Published Aug 13, 2026 · Assigned by VulnCheck

CVE-2026-73628Serendipity 2.3.5 Reflected XSS via search clean-URL route

Medium 6.1

In plain English

A medium-severity cross-site scripting in Serendipity from s9y. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 81.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/functions_routing.inc.php serveSearch(), the sanitisation pipeline runs urldecode() after HTML-encoding, so a single URL-encoded HTML payload survives strip_tags() and htmlspecialchars() and is then decoded back into live HTML in the page. A crafted search link can execute arbitrary JavaScript in the victim's browser. Fixed in 2.6.1.

Affected products (as reported)

Vendor	Product	Versions
s9y	Serendipity	2.3.5 – through 2.6.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-6c2x-mjmq-vx4q) vendor-advisory
VulnCheck Advisory: Serendipity 2.3.5 Reflected XSS via search clean-URL route third-party-advisory