CVE-2026-63169 Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attacker-controlled iframes through the messenger's HTMLPurifier SafeIframe branch. Attackers can craft a message with a malicious iframe that is...

CVE-2026-63169

Omnispace Agora Project versions prior to 26.10.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists in the messenger's HTMLPurifier SafeIframe branch, which fails to properly neutralize input, allowing authenticated users to post messages containing attacker-con...