CVE-2026-5010 - Reflected Cross-Site Scripting (XSS) in Sanoma’s Clickedu

Back Back to CVE browser

MEDIUM

Reflected Cross-Site Scripting (XSS) in Sanoma’s Clickedu

Published Mar 27, 2026

5.1

MEDIUM

CVSS 4.0

EPSS 0.44%

Description

A reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Clickedu. This vulnerability allows an attacker to execute JavaScript code in the victim’s browser by sending them a malicious URL using the endpoint “/user.php/”. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on the user’s behalf.

Affected products

Vendor Sanoma Product Clickedu Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <5.1
- Version
  5.1
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Sanoma

Clickedu

unaffected

Version	Status	Constraints
0	affected	<5.1
5.1	unaffected	-

Remediation

Vendor solution

The vulnerability has been fixed by the Sanoma team in version 5.1.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-16660		Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-sanomas-clickedu-0		patch