Helpy contains a stored cross-site scripting vulnerability in the post author display logic.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 29, 2026 · NIST NVD

   Detected

   Helpy contains a stored cross-site scripting vulnerability in the post author display logic. Any registered user can persist arbitrary HTML in their account name field and cause it to be rendered unescaped in public forum threads where they participate, in the admin ticket view, and in HTML notification emails sent to other users.This issue affects helpy: 2.8.0.

2. Jun 17, 2026 · NIST NVD

   Updated

   Helpy contains a stored cross-site scripting vulnerability in the post author display logic. Any registered user can persist arbitrary HTML in their account name field and cause it to be rendered unescaped in public forum threads where they participate, in the admin ticket view, and in HTML notification emails sent to other users.This issue affects helpy: 2.8.0.

Affected

• cpe helpy.io/helpy2.8.0

Sources

• CVE.orgVulnerability recordCVE-2026-40229

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-40229

  Helpy contains a stored cross-site scripting vulnerability in the post author display logic. Any registered user can persist arbitrary HTML in their account name field and cause it to be rendered unescaped in public forum threads where they participate, in the admin ticket view,

  nvd.nist.gov

References

• Exploit · fluidattacks.com
• Product · github.com