Security readout for executives and security teams
Plain-English summary
CVE-2018-17426 describes stored cross-site scripting in WUZHI CMS 4.1.0. Malicious content saved in the “SMS in station” field could later run in another user’s browser. The public record provides limited detail and no severity score, so urgency depends on whether this CMS version and feature exist in your environment.
Executive priority
Treat this as a targeted exposure check, not a confirmed emergency. Prioritize quickly if WUZHI CMS 4.1.0 is internet-facing, used by privileged staff, or supports customer/admin messaging.
Technical view
The source states WUZHI CMS 4.1.0 has stored XSS through the Extension module’s “SMS in station” field under an index.php?m=core URI. No CVSS, CWE, privilege requirements, fixed version, or patch information is provided in the bundle. CISA KEV status is false in the supplied data.
Likely exposure
Exposure is likely limited to organizations running WUZHI CMS 4.1.0, especially where the affected Extension module and “SMS in station” field are reachable. The source bundle does not identify hosted services, downstream products, or broader version ranges.
Exploitation context
The supplied sources do not show active exploitation, public weaponization, or KEV listing. Stored XSS generally matters because malicious input can persist and affect later users, but this record does not document attacker prerequisites or real-world activity.
Researcher notes
Evidence is sparse: the CVE title and description identify product, version, field, and route context, but not root cause, affected code, authentication requirements, impact scope, or remediation. Avoid expanding affected versions without vendor confirmation.
Mitigation direction
- Check WUZHI CMS vendor or project guidance for a fixed version or official mitigation.
- Upgrade away from WUZHI CMS 4.1.0 if a maintained fixed release is available.
- Restrict access to administrative or messaging functions until exposure is understood.
- Review stored “SMS in station” content for unexpected HTML or script-like input.
- Use output encoding and input validation consistent with the application framework.
Validation and detection
- Inventory whether WUZHI CMS 4.1.0 is deployed anywhere.
- Confirm whether the Extension module and “SMS in station” feature are enabled.
- Review access controls for users who can write to the affected field.
- Inspect stored messages and audit logs for suspicious content patterns.
- Track the GitHub issue and CVE record for fix or version-range updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-17426 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/wuzhicms/wuzhicms/issues/154CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.