Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck
CVE-2026-92814changedetection.io through 0.60.6 Cross-Site Scripting via watch_title
Medium 4.2
In plain English
A medium-severity cross-site scripting in changedetection.io from dgtlmoon. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Severity (CVSS 3.1)4.2Medium
Exploit odds (30 days)0.3%top 77.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watch_title token is used in templates.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| dgtlmoon | changedetection.io | 0 – through 0.60.6 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
References
- Researcher write-up, finding 1 technical-description, exploit
- the escape set omits watch_title technical-description
- https://github.com/dgtlmoon/changedetection.io product
- VulnCheck Advisory: changedetection.io through 0.60.6 Cross-Site Scripting via watch_title third-party-advisory