HIGH

CVE-2026-90943

2026-09-14 CVSS v3.1

CVSS

8.7

Description

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those comments, including administrators, enabling session token theft and unauthorized actions.

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

EPSS Score

0.24%

Probability of exploitation in next 30 days

14.9th percentile

References

https://github.com/parallax/filament-comments/blob/3.0.0/resources/views/comments.blade.php https://github.com/parallax/filament-comments/blob/3.0.0/src/Policies/FilamentCommentPolicy.php https://hackindex.io/research/stored-xss-filament-comments-unescaped-rendering https://packagist.org/packages/parallax/filament-comments https://www.vulncheck.com/advisories/parallax-filament-comments-through-3.0.0-stored-xss-via-comment-body

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE