by Kastro
Paper/Archive/CVE-2026-90943

CVE-2026-90943

parallax filament-comments — parallax filament-comments through 3.0.0 Stored XSS via Comment Body

EPSS 0.4%CVSS 9.3
critical.is priorityof 100
35
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 37.3.373 × 207.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those comments, including administrators, enabling session token theft and unauthorized actions.

Affected

ProductAffectedFixed inSource
filament-comments≤ 3.0.0–CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
VulnCheck (CNA)8.7CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeuphackindex.io/research/stored-xss-filament-comments-unescaped-renderingwriteupgithub.com/parallax/filament-comments/blob/3.0.0/resources/views/comments.blade.phpwriteupgithub.com/parallax/filament-comments/blob/3.0.0/src/Policies/FilamentCommentPolicy.phprefpackagist.org/packages/parallax/filament-commentswriteupvulncheck.com/advisories/parallax-filament-comments-through-3.0.0-stored-xss-via-comment-body