Haxtheweb Iframe-loader vulnerabilities

• haxtheweb haxcms-nodejs, iframe-loader, video-player +2 more HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover CVE-2026-46396 Fix available 9.3 CriticalMay 19, 2026