ZeroDay Findings
Sign inSign up

Findings

CVE-2026-40353

wger is a free, open-source workout and fitness manager.

Published Apr 17, 2026 · updated Jun 17, 2026 · wger wger

wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the attribution_link property in AbstractLicenseModel constructs HTML by directly interpolating user-controlled license fields (such as license_author) without escaping, and templates render the result using Django's |safe filter. An authenticated user can create an ingredient with a malicious license_author value containing JavaScript, which executes in the browser of any visitor viewing the ingredient page, resulting in stored XSS. This issue has been fixed in version 2.5.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 17, 2026 · NIST NVD

    Detected

    wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the attribution_link property in AbstractLicenseModel constructs HTML by directly interpolating user-controlled license fields (such as license_author) without escaping, and templates render the result using Django's |safe filter. An authenticated user can create an ingredient with a malicious license_author value

  2. Jun 17, 2026 · NIST NVD

    Updated

    wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the attribution_link property in AbstractLicenseModel constructs HTML by directly interpolating user-controlled license fields (such as license_author) without escaping, and templates render the result using Django's |safe filter. An authenticated user can create an ingredient with a malicious license_author value

Affected

  • cpe wger/wgerversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-40353

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-40353

    wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the attribution_link property in AbstractLicenseModel constructs HTML by directly interpolating user-controlled license fields (such as license_author) without escaping, and templates render the r

    nvd.nist.gov

References