CVE-2026-7596 Details
Description
A vulnerability has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this issue is the function data.get of the file .claude/skills/design-system/scripts/generate-slide.py of the component Slide Generator. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a pull request but has not reacted yet.
A stored cross-site scripting vulnerability has been identified in the Nextlevelbuilder UI-UX Pro Max Skill, specifically in versions through 2.5.0. The issue resides in the Slide Generator component, within the function data.get of the file .claude/skills/design-system/scripts/generate-slide.py. This vulnerability allows for the injection of unescaped HTML, which can be exploited to execute malicious scripts. The flaw can be triggered remotely by embedding harmful JavaScript into the JSON data input, which the Slide Generator then processes and outputs as part of an HTML presentation deck. When this generated HTML is viewed in a web browser, the injected scripts are executed, leading to potential cookie theft, session hijacking, and other malicious actions.
The vulnerability can be remediated by HTML-encoding all user data before embedding it into the generated HTML. Additionally, URLs injected into href attributes should be validated to ensure they do not contain harmful JavaScript: protocols.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 1, 2026CISA-ADP
Assessed May 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/issues/247 | CISA-ADP | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/ | [email protected] | Vendor |
| https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/issues/247 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/pull/274 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/submit/805510 | [email protected] | Permission Required |
| https://vuldb.com/vuln/360549 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/360549/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nextlevelbuilder ui-ux-pro-max-skill | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 2, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | New CVE Received | [email protected] |