Vulnerability · Published Apr 30, 2026 · Assigned by VulnCheck

CVE-2026-7429SSCMS v7.4.0 Reflected Cross-Site Scripting via STL Processing

Medium 4.6

In plain English

A medium-severity cross-site scripting in SSCMS from siteserver. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)4.6Medium

Exploit odds (30 days)0.2%top 89.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attackers to execute arbitrary JavaScript by crafting malicious STL template payloads that are decrypted and returned without proper sanitization. Attackers can exploit improper output encoding in the /api/stl/actions/dynamic endpoint to inject executable JavaScript into JSON responses, leading to session hijacking, phishing attacks, and unauthorized actions performed on behalf of users.

Affected products (as reported)

Vendor	Product	Versions
siteserver	SSCMS	7.4.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/siteserver/cms/issues/3892 issue-tracking
https://github.com/siteserver/cms product
https://www.vulncheck.com/advisories/sscms-reflected-cross-site-scripting-via-stl-processing third-party-advisory