CVE-2026-63001 REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`

REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse handler in redaxo/src/addons/mediamanager/lib/mediamanager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIAISINUSE. An administrator with Media...

CVE-2026-63001

REDAXO CMS (prior to version 5.21.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to an unescaped media manager type name in the mediaIsInUse() handler. Located in redaxo/src/addons/media_manager/lib/media_manager.php, the system fails to use rex_escape() when constructing an HTML anch...