Vulnerability · Published Sep 23, 2026 · Assigned by INCIBE
CVE-2026-5696Multiple vulnerabilities in the Microweber administration panel
Medium 5.9
In plain English
A medium-severity cross-site scripting in Administration panel from Microweber. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Official description
Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser. This enables the attacker to perform actions without the victim’s consent, steal confidential information or hijack the user’s session.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microweber | Administration panel | 2.0.19 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N