CVE-2026-2735: Alkacon Opencms

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

Stored Cross-Site Scripting (XSS) in Alkacon's OpenCms v18.0, which occurs when user input is not properly validated when sending a POST request to ‘/blog/new-article/org.opencms.ugc.CmsUgcEditService.gwt’ using the ‘text’ parameter.

Affected products

• Alkacon Opencms: version 18.0.0 only

Published 2026-02-19. Last modified 2026-06-17.