Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Helpy contains a stored cross-site scripting vulnerability in the post author display logic. Any registered user can persist arbitrary HTML in their account name field and cause it to be rendered unescaped in public forum threads where they participate, in the admin ticket view, and in HTML notification emails sent to other users.This issue affects helpy: 2.8.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-40229 Stored Cross-Site Scripting in Helpy 2.8.0 Post Author Display Logic https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40229
Post summary
The brief entry identifies CVE‑2026‑40229 as a stored XSS issue in Helpy 2.8.0, with no additional detail on exploit availability or remediation.
CVE-2026-40229 Helpy contains a stored cross-site scripting vulnerability in the post author display logic. Any registered user can persist arbitrary HTML in their account name fiel… https://www.cve.org/CVERecord?id=CVE-2026-40229
Post summary
The post discloses that CVE-2026-40229 is a stored XSS issue in Helpy, enabling any registered user to inject persistent arbitrary HTML into the account name field.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | helpy.io | helpy | 2.8.0 | - | - |