CVE-2018-11352
Wallabag cross-site scripting (XSS) vulnerability
The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be exploited with authentication and used to target administrators and steal their sessions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be exploited with authentication and used to target administrators and steal their sessions.
- Record
CVE-2018-11352- CVSS 3.0
- 4.0 Medium
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 2.1 Low
AV:N/AC:H/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be exploited with authentication and used to target administrators and steal their sessions.
- Record
CVE-2018-11352- Updated
- 2026-11-02
EUVDEUVD-2022-4016 No score
The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be exploited with authentication and used to target administrators and steal their sessions.
- Record
EUVD-2022-4016- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gvcw-x64m-pfcj
Wallabag cross-site scripting (XSS) vulnerability
The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be exploited with authentication and used to target administrators and steal their sessions.
- Record
GHSA-gvcw-x64m-pfcj- CVSS 3.0
- 4.0 Medium
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be exploited with authentication and used to target administrators and steal their sessions.
- Record
CVE-2018-11352- CVSS 3.0
- 4.0 Medium
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-gvcw-x64m-pfcj
Wallabag cross-site scripting (XSS) vulnerability
The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be exploited with authentication and used to target administrators and steal their sessions.
- Record
GHSA-gvcw-x64m-pfcj- CVSS 3.0
- 4.0 Medium
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wallabag/wallabagPackagist |
2.2.3 up to 2.3.3 | 2.3.3 |
wallabag/wallabagPackagist |
2.2.3 up to 2.3.3, plus listed versions 2.3.02.3.12.3.2 |
2.3.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-11352 is a medium vulnerability (CVSS 4.0) in Wallabag, published September 21, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in wallabag/wallabag 2.3.3.