CVE-2026-18741
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Worksuite SaaS versions prior to 6.0.14 contain a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset. Stored scripts execute automatically in the browsers of any user who views the affected asset, potentially leading to session hijacking, credential theft, and unauthorized actions.
Risk Assessment
An attacker can hijack user sessions, steal credentials, or perform actions on behalf of authenticated users, posing a serious security threat to the application.
Recommendation
Update Worksuite SaaS to version 6.0.14 or later as soon as possible, which includes a fix for the XSS vulnerability.
Original NVD description (English source)
Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset. Attackers can store crafted HTML script tags in the application database that execute automatically in the browsers of any user who views the affected asset, potentially leading to session hijacking, credential theft, and unauthorized actions on behalf of authenticated users.