CVE-2026-40286

High

Published: 17 April 2026

Published

17 April 2026

Modified

20 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Score 0.0004 13.8th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-40286 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2026-40286 is a Stored Cross-Site Scripting (XSS) vulnerability, classified under CWE-79, affecting WeGIA versions prior to 3.6.10. WeGIA is a web manager for charitable institutions. The flaw exists in the 'Member Registration' (Cadastrar Sócio) function, where an attacker can inject a malicious payload into the 'Member Name' (Nome Sócio) field, resulting in the script being persistently stored in the database.

The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), indicating it is exploitable over the network with low complexity, no privileges, no user interaction, and unchanged scope, primarily impacting integrity. An unauthenticated remote attacker can submit a crafted payload during member registration, which then executes in the browsers of any users navigating to affected URLs, potentially allowing script execution in victim contexts.

The GitHub Security Advisory at https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-42rc-rvrx-cmmw documents the issue, confirming that WeGIA version 3.6.10 resolves the vulnerability. Security practitioners should upgrade to this patched version to mitigate the risk.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-23531

Vulnerability details

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the 'Member Registration' (Cadastrar Sócio) function. By injecting a payload into the 'Member Name' (Nome Sócio) field, the…

script is persistently stored in the database. Consequently, the payload is executed whenever a user navigates to certain URL. Version 3.6.10 fixes the issue.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Stored XSS in public-facing web app (WeGIA) allows unauthenticated remote injection and persistent script execution in victim browsers, directly enabling T1190 Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1