---
id: CVE-2026-90943
title: >-
  parallax filament-comments through 3.0.0 contains a stored cross-site
  scripting vulnerability in comment body rendering that allows authenticated
  panel users to inject malicious scripts
summary: >-
  parallax filament-comments through 3.0.0 contains a stored cross-site
  scripting vulnerability in comment body rendering that allows authenticated
  panel users to inject malicious scripts. Attackers can store XSS payloads in
  comment bodies…
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'
cwe:
  - CWE-79
vendor: parallax
product: parallax/filament-comments
affected:
  - parallax/filament-comments <= 3.0.0
published: '2026-09-14'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90943'
references:
  - url: >-
      https://github.com/parallax/filament-comments/blob/3.0.0/resources/views/comments.blade.php
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/parallax/filament-comments/blob/3.0.0/src/Policies/FilamentCommentPolicy.php
    label: disclosure@vulncheck.com
  - url: >-
      https://hackindex.io/research/stored-xss-filament-comments-unescaped-rendering
    label: disclosure@vulncheck.com
  - url: 'https://packagist.org/packages/parallax/filament-comments'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/parallax-filament-comments-through-3.0.0-stored-xss-via-comment-body
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.0043
epssPercentile: 0.34605
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-14T19:21:27.866482Z'
ingestedAt: '2026-09-14T17:11:16.568Z'
---

## Overview

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those comments, including administrators, enabling session token theft and unauthorized actions.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.