CVE-2026-40229
Helpy 2.8.0 - Stored XSS in post author display via PostsHelper
- State
- Published
- Severity
- 5.1 Medium
- Published
- Apr 29, 2026
- Updated
- Apr 29, 2026
- Reserved
- Apr 10, 2026
Description
Helpy contains a stored cross-site scripting vulnerability in the post author display logic. Any registered user can persist arbitrary HTML in their account name field and cause it to be rendered unescaped in public forum threads where they participate, in the admin ticket view, and in HTML notification emails sent to other users.This issue affects helpy: 2.8.0.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | Fluid Attacks |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
helpyhelpyio |
|
References
- https://fluidattacks.com/es/advisories/offspringthird-party-advisory
- https://github.com/helpyio/helpyproduct
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.