Vulnerability · Published Jul 22, 2026 · Assigned by VulnCheck

CVE-2026-64828Froiden TableTrack 1.3.10 Stored XSS via Order Notes Field

Medium 6.1

In plain English

A medium-severity cross-site scripting in TableTrack from Froiden. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.4%top 69.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaScript through the order notes field without sanitization. Attackers can craft malicious payloads in customer order placement that execute in the admin's browser session when viewing order details, enabling session token theft or unauthorized administrative actions.

Affected products (as reported)

Vendor	Product	Versions
Froiden	TableTrack	0 – through 1.3.10

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Researcher Disclosure technical-description, exploit
Project Webpage product
https://www.vulncheck.com/advisories/froiden-tabletrack-stored-xss-via-order-notes-field third-party-advisory
http://seclists.org/fulldisclosure/2026/Aug/31