CVE-2026-37503 Details
Description
Cross-Site Scripting (XSS) in V2Board thru 1.7.4. The custom_html field in theme configuration is rendered using Blade unescaped output in public/theme/v2board/dashboard.blade.php. An admin can inject arbitrary JavaScript via the saveThemeConfig API. All site visitors execute the payload, enabling cookie theft, session hijacking, or phishing.
A stored cross-site scripting vulnerability has been identified in V2Board versions through 1.7.4. The issue arises in the theme configuration's custom_html field, which is rendered using unescaped Blade output. This flaw allows an admin to inject arbitrary JavaScript via the saveThemeConfig API. The injected script is executed by all site visitors, potentially leading to cookie theft, session hijacking, or phishing.
To address this vulnerability, the output rendering should be changed to use escaped interpolation or apply a filtering method equivalent to wp_kses before storing the custom HTML.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9 | [email protected] | ExploitThird Party Advisory |
| https://github.com/v2board/v2board | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| v2board v2board | <= 1.7.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | Initial Analysis | [email protected] |
| May 1, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | New CVE Received | [email protected] |