CVE-2026-5010
Medium
Description
A reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Clickedu. This vulnerability allows an attacker to execute JavaScript code in the victim’s browser by sending them a malicious URL using the endpoint “/user.php/”. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on the user’s behalf.
SeverityMedium
CVSS5.1
Exploit probability—
ProductClickedu
PublishedMar 27, 2026
First seenMar 27, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- Sanoma Clickedu5.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Sanoma Clickedu | v < 5.1 | 5.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.