CVE-2026-120190 Details
Description
A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown functionality of the file ui/src/views/submissions/submission-forms/form-components/DescriptionInput.tsx of the component Submission Description Editor. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.1.76 addresses this issue. The patch is identified as 6b11c2345ad98ae59fd5404a9f1024eb1d10c8a4. It is advisable to upgrade the affected component.
A cross-site scripting (XSS) vulnerability has been identified in PostyBirb Plus versions through 3.1.75. The issue arises in the Submission Description Editor component, specifically within the file 'ui/src/views/submissions/submission-forms/form-components/DescriptionInput.tsx'. This vulnerability can be exploited remotely, allowing an attacker to inject malicious scripts that could be executed in the context of the user's session.
Users are advised to upgrade to PostyBirb Plus version 3.1.76, which addresses this vulnerability by applying proper sanitization to the description field before it is rendered in the editor. The update is available on the PostyBirb Plus GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 1, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mvdicarlo/postybirb-plus/commit/6b11c2345ad98ae59fd5404a9f1024eb1d10c8a4 | [email protected] | Source CodeVendor |
| https://github.com/mvdicarlo/postybirb-plus/issues/504 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/mvdicarlo/postybirb-plus/pull/506 | [email protected] | Issue TrackingVendor |
| https://github.com/mvdicarlo/postybirb-plus/releases/tag/v3.1.76 | [email protected] | Release NotesVendor |
| https://github.com/user-attachments/files/32685547/report.md | [email protected] | Broken Link |
| https://vuldb.com/cve/CVE-2026-120190 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1027356 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/429529 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/429529/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PostyBirb Plus | <= 3.1.75 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 1, 2026 | New CVE Received | [email protected] |