VulnSocial

CVE-2026-2276General

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Reflected Cross-Site Scripting (XSS) vulnerability in the Wix web application, where the endpoint ' https://manage.wix.com/account/account-settings ', responsible for uploading SVG images, does not properly sanitize the content. An authenticated attacker could upload an SVG file containing embedded JavaScript code, which is stored and subsequently executed when other users view the image. Exploiting this vulnerability allows arbitrary code to be executed in the context of the victim's browser, which could lead to the disclosure of sensitive information or the abuse of the affected user's session.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 5 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • General: 3 classified signals
  • Disclosure: 2 classified signals
  • Peaked 2d ago at 2 mentions (2026-02-12); latest day: 1
  • 5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d
01122Mentions · 2026-02-12: 2Mentions · 2026-05-18: 2Mentions · 2026-05-19: 1Technical Details · 2026-02-12: 202-1205-1805-19
Signal classification2 categories
General
360.0%
Disclosure
240.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-02-122
Disclosure2
2026-05-182
General2
2026-05-191
General1
Full discourse5 posts
  • INCIBE-CERT@incibe_cert
    Disclosure

    ⚠️#INCIBEaviso | Cross-Site Scripting reflejado en la aplicación web de #Wix #CVE CVE-2026-2276 https://www.incibe.es/incibe-cert/alerta-temprana/avisos/cross-site-scripting-reflejado-en-la-aplicacion-web-de-wix #AvisosDeSeguridad #CNA https://t.co/SS3Q2NUAEM

    Post summary

    INCIBE alert announces a reflected cross‑site scripting vulnerability (CVE‑2026‑2276) affecting Wix’s web application, with no evidence of PoC, exploitation, or patch information disclosed.

    02060440
    42.5K followersView on X
  • Protect Western Heritage@DigitalVagrant
    General

    @RobinW1966 You should probably be careful at this point... Just saying... CVE-2026-2276

    Post summary

    The message merely warns of CVE‑2026‑2276 without providing technical, exploit, or patch information.

    10100139
    30.0K followersView on X
  • CVETrends@CVEShield
    General

    Top 5 Trending CVEs: 1 - CVE-2026-2276 2 - CVE-2026-42945 3 - CVE-2026-20182 4 - CVE-2026-40369 5 - CVE-2026-29205 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard

    Post summary

    The post simply lists trending CVEs without providing additional context, technical details, or implications.

    00010200
    1.7K followersView on X
  • Robin Whitlock 🇮🇱🇵🇸🇪🇺🇺🇦@RobinW1966
    General

    Can anyone tell me, in simple language, what CVE-2026-2276 is? And what this chap appears to be threatening to do? Thanks.

    Post summary

    The user is simply asking for a basic explanation of CVE-2026-2276 and what the referenced individual might intend to do, without providing or referencing any technical details, PoC, or exploitation activity.

    1000075
    275 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-2276 Reflected Cross-Site Scripting (XSS) vulnerability in the Wix web application, where the endpoint ' https://manage.wix.com/account/account-settings ', responsible for u… https://www.cve.org/CVERecord?id=CVE-2026-2276

    Post summary

    The post announces CVE‑2026‑2276, a reflected XSS flaw in Wix’s account settings endpoint, but does not provide PoC, exploit, or mitigation information.

    00010353
    56.5K followersView on X

Explore more

Back to dashboard