Platform
php
Component
baykeshop
Fixed in
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.3.8
1.3.9
1.3.10
1.3.11
1.3.12
1.3.13
1.3.14
1.3.15
1.3.16
1.3.17
1.3.18
1.3.19
1.3.20
1.3.21
CVE-2026-3041 describes a cross-site scripting (XSS) vulnerability affecting xingfuggz BaykeShop versions 1.3.0 through 1.3.20. This vulnerability allows attackers to inject malicious scripts into the application, potentially leading to session hijacking or defacement. The issue resides within the Article Sidebar Module's custom.html template file. While a fix has not been released by the vendor, mitigation strategies are available.
An attacker can exploit this XSS vulnerability by crafting a malicious payload and injecting it into the sidebar.content argument within the src/baykeshop/contrib/article/templates/baykeshop/sidebar/custom.html file. Successful exploitation allows the attacker to execute arbitrary JavaScript code in the context of the user's browser. This can lead to the theft of sensitive information, such as session cookies, allowing the attacker to impersonate the user. Furthermore, the attacker could redirect users to malicious websites or deface the website's appearance. The impact is amplified if the application is used by a large number of users or handles sensitive data.
This vulnerability was publicly disclosed on 2026-02-23. A proof-of-concept exploit is likely available given the public disclosure. The vulnerability is currently assessed as LOW severity based on the CVSS score. No indication of active exploitation campaigns or KEV listing at the time of writing.
Exploit Status
EPSS
0.01% (2% percentile)
CISA SSVC
CVSS Vector
Due to the lack of a vendor-provided patch, immediate mitigation is crucial. Implement strict input validation and output encoding on all user-supplied data, particularly within the Article Sidebar Module. Utilize a Web Application Firewall (WAF) to filter out potentially malicious requests targeting the vulnerable endpoint. Consider implementing Content Security Policy (CSP) to restrict the sources from which scripts can be executed. Regularly scan the application for vulnerabilities using automated tools. While a direct fix is unavailable, these measures can significantly reduce the risk of exploitation.
Update the Article Sidebar module to a version later than 1.3.9, if available. If no updates are available, disable or remove the module to mitigate the XSS vulnerability. Alternatively, review and sanitize the 'sidebar.content' input to prevent malicious code injection.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-3041 is a cross-site scripting (XSS) vulnerability in xingfuggz BaykeShop versions 1.3.0–1.3.20, allowing attackers to inject malicious scripts.
You are affected if you are using xingfuggz BaykeShop versions 1.3.0 through 1.3.20 and have not implemented mitigating controls.
A vendor patch is not currently available. Mitigate by implementing input validation, output encoding, WAF rules, and CSP.
While no active exploitation campaigns are confirmed, the vulnerability is publicly disclosed and a proof-of-concept is likely available.
Check the xingfuggz BaykeShop website or GitHub repository for updates and advisories regarding CVE-2026-3041.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.