CVE-2026-2678: Wolterskluwer a3factura

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'name', parameter 'name', in 'a3factura-app.wolterskluwer.es/#/incomes/customers' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser.

Affected products

• Wolterskluwer a3factura: version 4.111.2 only

Published 2026-02-26. Last modified 2026-06-17.