CVE-2026-126569

Mbin versions 1.2.1 before 1.11.1 are vulnerable to a stored cross-site scripting (XSS) flaw within the EmbedElement::buildDestructed() function. The root cause is the failure to perform HTML escaping when rendering nested Markdown image alt text and URLs. Consequently, authenticated users can em...