Froxlor: Stored cross-site scripting via customer theme value
Summary
Froxlor 2.0.0 before 2.3.14 does not properly validate the theme value that authenticated customers can set in the panel. The stored value is output unescaped in the admin customer overview, so script runs in the browser of an administrator who has the Theme column enabled. An attacker could use this to act with administrator rights, for example to create administrator accounts or change server settings, using the administrator's CSRF token.
Affected
- Froxlor 2.0.0 to before 2.3.14 (2.0.0 through 2.3.13)
Fixed in
- Froxlor 2.3.14 (the vendor advisory lists 2.3.14 as the patched version)
Workaround
Unknown. No vendor workaround is documented because a fixed version is available. Until the update is applied:
- Remove or restrict customer accounts that are not needed.
- Do not enable the Theme column in the customer overview.
- Check stored customer theme values in the database for HTML or script content.
Exploitation
- CISA SSVC rates exploitation as "poc" (proof of concept exists) and automatable as "no".
- Not marked as known exploited.
- EPSS score 0.00292 (low).
Our recommendation
- Update Froxlor to 2.3.14 or later on all instances with customer accounts, starting with internet-facing and multi-customer systems.
- Until the update is done, disable the Theme column for all administrators.
- Review customer theme values for script content.
- The research notes point to a separate Froxlor flaw (CVE-2026-113678) fixed in 2.3.15. This is unverified; check the vendor advisory and consider 2.3.15.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-3jpp-mhvh-rv66 github.com
- VulnCheck advisory: Froxlor stored XSS via customer theme value www.vulncheck.com
- OSV: CVE-2026-109960 osv.dev
- Froxlor 2.3.14 release github.com
- VulDB entry 417668 vuldb.com
- Vulners VulnCheck record for CVE-2026-109960 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:31.
Original description (NVD)
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.