CVE-2026-29598: Acora CMS Stored XSS Vulnerability

CVE-2026-29598 Overview

Multiple stored cross-site scripting (XSS) vulnerabilities have been identified in DDSN Interactive Acora CMS v10.7.1. The vulnerabilities exist in the submit_add_user.asp endpoint, which fails to properly sanitize user-supplied input in the First Name and Last Name parameters. Attackers with low privileges can inject malicious JavaScript or HTML payloads that are stored in the application database and subsequently executed in the browsers of other users who view the affected content.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in victim browsers, potentially leading to session hijacking, credential theft, account takeover, or further attacks against other authenticated users including administrators.

Affected Products

• DDSN Interactive Acora CMS v10.7.1
• Acora CMS submit_add_user.asp endpoint

Discovery Timeline

• 2026-04-01 - CVE-2026-29598 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-29598

Vulnerability Analysis

This stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) affects the user management functionality within Acora CMS. The submit_add_user.asp endpoint processes user registration or profile creation requests but fails to implement adequate input validation and output encoding for the First Name and Last Name form fields.

When an attacker submits specially crafted input containing JavaScript code or HTML markup through these parameters, the malicious content is stored directly in the application's database without sanitization. Subsequently, when other users—including administrators—view pages that display this user information, the injected scripts execute within their browser context.

The attack requires network access and low-level authentication to submit the malicious payload. However, the impact extends beyond the attacker's session scope, as the stored payload affects other users who interact with the compromised data. This cross-scope impact enables attackers to target users with higher privileges than their own.

Root Cause

The root cause of this vulnerability is improper input validation and missing output encoding in the submit_add_user.asp endpoint. The application directly stores user-supplied data from the First Name and Last Name parameters without sanitizing special characters or encoding HTML entities. When this data is later rendered in the browser, the lack of proper contextual output encoding allows the injected scripts to execute as legitimate code.

Attack Vector

The attack is conducted over the network and requires the attacker to have low-level authenticated access to the Acora CMS application. The attacker navigates to the user creation or profile functionality and submits a form with malicious JavaScript embedded in the First Name or Last Name fields. The payload is then stored persistently and triggers whenever other users view the affected content. User interaction is required for the attack to succeed—a victim must view the page containing the stored payload.

The vulnerability enables potential session hijacking through cookie theft, defacement of application content, redirection to malicious sites, keylogging of user input, and propagation of further attacks against other authenticated users.

Detection Methods for CVE-2026-29598

Indicators of Compromise

• Unusual JavaScript code or HTML tags present in user profile First Name or Last Name database fields
• HTTP POST requests to submit_add_user.asp containing encoded script tags or event handlers (e.g., <script>, onerror=, onload=)
• User profile data containing suspicious patterns such as javascript:, <iframe>, or base64-encoded payloads

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing XSS payloads targeting the submit_add_user.asp endpoint
• Monitor application logs for POST requests to user management endpoints with suspicious parameter values
• Conduct periodic database audits to identify stored content containing HTML or JavaScript syntax in name fields

Monitoring Recommendations

• Enable detailed logging for the submit_add_user.asp endpoint and related user management functions
• Configure alerting for requests containing common XSS payload patterns in form submissions
• Implement Content Security Policy (CSP) headers to detect and report inline script execution attempts

How to Mitigate CVE-2026-29598

Immediate Actions Required

• Review all existing user records in the database for malicious content in First Name and Last Name fields and sanitize any suspicious entries
• Implement strict input validation to reject or strip HTML tags and JavaScript from user profile fields
• Apply output encoding (HTML entity encoding) whenever displaying user-supplied data in web pages
• Consider restricting access to the user management functionality until a patch is available

Patch Information

No official vendor patch information is currently available for this vulnerability. Organizations should monitor the DDSN Security Insights page and Acora Security Overview for updates. A proof-of-concept has been published on GitHub, which organizations can reference when testing mitigations.

Workarounds

• Implement server-side input validation to strip or encode HTML special characters (<, >, ", ', &) from the First Name and Last Name parameters before storage
• Deploy a web application firewall (WAF) with XSS detection rules to filter malicious requests to the submit_add_user.asp endpoint
• Implement Content Security Policy (CSP) headers with restrictive script-src directives to prevent execution of inline scripts
• Apply the principle of least privilege to limit which user roles can access the user creation functionality

# Example Content Security Policy header configuration (Apache)
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none';"