Cross-site Scripting (XSS) - Reflected in forkcms/forkcms


Reported on

Aug 5th 2021

✍️ Description

The forkcms is vulnerable to XSS through settings translation

🕵️‍♂️ Proof of Concept

  1. Go to
  2. In search box named "Reference code" input "><svg/onload=alert(document.domain)>
  3. XSS payload will be executed

💥 Impact

An attacker can execute JavaScript code in the website


We have contacted a member of the forkcms team and are waiting to hear back a year ago
Jelmer Prins confirmed that a fix has been merged on 18b36b a year ago
Jelmer Prins has been awarded the fix bounty
to join this conversation