Cross-site scripting in FacturaScripts - CVE-2026-45710
Published: November 9, 2026
Vulnerability identifier: #VU163111
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-45710
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a highly privileged authenticated attacker to execute stored JavaScript in another user's FacturaScripts session.
The vulnerability exists due to HTML-escaped quotes being decoded inside JavaScript event handlers in WidgetVariante and WidgetSubcuenta picker rows. A highly privileged authenticated attacker can plant malicious variant references or subaccount codes through authorized editing or database writes and execute scripts when a victim clicks a poisoned picker row, with variant exploitation requiring a plugin form using default reference matching.
Affected software
FacturaScripts
How to mitigate CVE-2026-45710
Install security update from vendor's website.
FacturaScripts - update to 2026.2