CVE-2026-90943
parallax filament-comments through 3.0.0 Stored XSS via Comment Body
- State
- Published
- Severity
- 9.3 Critical
- Published
- Sep 14, 2026
- Updated
- Sep 14, 2026
- Reserved
- Sep 14, 2026
Description
parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those comments, including administrators, enabling session token theft and unauthorized actions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N | VulnCheck |
| 3.1 | 8.7 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
filament-commentsparallax |
|
References
- HackIndex: Stored XSS in parallax/filament-comments through unescaped comment renderingthird-party-advisorytechnical-description
- https://github.com/parallax/filament-comments/blob/3.0.0/resources/views/comments.blade.phptechnical-description
- https://github.com/parallax/filament-comments/blob/3.0.0/src/Policies/FilamentCommentPolicy.phptechnical-description
- https://packagist.org/packages/parallax/filament-commentsproduct
- VulnCheck Advisory: parallax filament-comments through 3.0.0 Stored XSS via Comment Bodythird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.