CVE-2026-64671

The Waline comment system (versions 3.15.2 and prior ) is vulnerable to Stored Cross-Site Scripting (XSS) . The issue exists in the @waline/client UserList widget , which concatenates server-returned commenter fields, such as the nick and link , directly into root.innerHTML without HTML escaping....