CVE-2026-1591 — Stored XSS via Attachments Feature in https://pdfonline.foxit.com/

CVE-2026-1591

Stored XSS via Attachments Feature in https://pdfonline.foxit.com/ PUBLISHED

Description (CNA)

Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature. A malicious username is embedded into the upload file list without proper escaping, allowing arbitrary JavaScript execution when the list is displayed. This issue affects pdfonline.foxit.com: before 2026‑02‑03.

Affected (CNA)

Vendor / product	Versions
Foxit Software Inc. / pdfonline.foxit.com	affected before 2026‑02‑03

CWE

CWE-79

References

https://www.foxit.com/support/security-bulletins.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.