CVE-2026-48910

mediumCVSS 6.5covered by 1 sourcefirst seen 2026-07-30

A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This issue affects Apache JSPWiki: through 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes the issue.

⚡ Watch CVE-2026-48910

Get an email if CVE-2026-48910 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all EPSS-scored CVEs.

Advisory coverage (1)

mediumCVE-2026-48910: A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when …nvd · 2026-07-30

External references

NVD record for CVE-2026-48910

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-48910 status](https://www.csirts.com/badge/CVE-2026-48910)](https://www.csirts.com/cve/CVE-2026-48910)