CVE-2026-3050: XSS in horilla Leads Module

An attacker can exploit this XSS vulnerability by crafting a malicious payload within the 'Notes' field of the Leads Module. This payload, when processed by the application, will be executed in the context of a user's browser. This could lead to session hijacking, defacement of the application, or the theft of sensitive information like login credentials. The remote nature of the vulnerability means an attacker doesn't need local access to exploit it, significantly expanding the potential attack surface. The published proof-of-concept increases the likelihood of exploitation.

1. Reserved2026-02-23
2. Published2026-02-24
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-3050 is to upgrade the horilla Leads Module to version 1.0.3 or later. If an immediate upgrade is not possible, consider implementing input validation and sanitization on the 'Notes' field to prevent the injection of malicious scripts. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Verify the upgrade by attempting to submit a crafted payload in the 'Notes' field after the upgrade; the payload should be properly sanitized and not execute.