CVE-2026-5362 — Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering
An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution when the published p…
Published: 2026-04-27 · CVSS: 4.8 · CVSS 4.0
An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution when the published page is rendered. This issue affects pimcore: v12.3.3.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7