5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40353

CVE-2026-40353: wger: Stored XSS via Unescaped License Attribution Fields

wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the attribution_link property in AbstractLicenseModel constructs HTML by directly interpolating user-controlled license fields (such as license_author) without escaping, and templates render the result using Django's |safe filter. An authenticated user can create an ingredient with a malicious license_author value containing JavaScript, which executes in the browser of any visitor viewing the ingredient page, resulting in stored XSS. This issue has been fixed in version 2.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40353

CVE-2026-40353:

5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
wger	pip	<= 2.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability analysis began by examining the provided description, which clearly identified a stored XSS vulnerability in the wger application. The root cause was specified as the AbstractLicenseModel.attribution_link property in wger/utils/models.py, where user-controlled data was used to construct raw HTML without proper escaping. The advisory mentioned that version 2.5 contained the patch. By comparing the git tags for version 2.4 and 2.5, I identified a series of commits. Within these commits, one stood out with the message 'Properly escape generated HTML' (commit b9a262b0d0e9a75d2d4599beaf4a25fa4bb39bcc). Analyzing this commit's diff confirmed it was the security patch. The patch file wger/utils/models.py showed the vulnerable attribution_link property being refactored to use django.utils.html.format_html and escape instead of unsafe f-string interpolation. This directly confirms that AbstractLicenseModel.attribution_link is the vulnerable function, as it's the precise location where the unsafe HTML was generated. During exploitation, this function would be called when rendering a page that displays the license information, causing the stored malicious script to execute.

Vulnerable functions

AbstractLicenseModel.attribution_link

wger/utils/models.py

The `attribution_link` property in the `AbstractLicenseModel` class constructs an HTML string using f-string formatting. It directly interpolates user-controlled fields like `license_author` and `license_title` into the HTML without any escaping. The resulting raw HTML is later rendered in a template using Django's `|safe` filter, which disables auto-escaping. This allows an authenticated user to inject malicious JavaScript into these fields, leading to a stored Cross-Site Scripting (XSS) vulnerability that executes when any user views the page containing the attribution link.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.