CVE-2026-126498

WriteFreely versions before 0.17.3 are vulnerable to a stored cross-site scripting (XSS) vulnerability. This issue occurs because the CreatePost API fails to sanitize a malicious post slug, which is subsequently concatenated into an anchor by the augmentReadingDestination() function for paid-shor...