CVE-2026-1592 PUBLISHED

Stored XSS via Create New Layer Field found in Foxit PDF Editor Cloud

Assigner: Foxit
Reserved: 29.01.2026 Published: 03.02.2026 Updated: 03.02.2026

Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the Create New Layer feature. Unsanitized user input is embedded into the HTML output, allowing arbitrary JavaScript execution when the layer is referenced.

This issue affects pdfonline.foxit.com: before 2026‑02‑03.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
CVSS Score: 6.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	Low
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Foxit Software Inc.
Product	pdfonline.foxit.com
Versions	Default: unaffected Version before 2026‑02‑03 is affected

Credits

Novee finder

References

https://www.foxit.com/support/security-bulletins.html

Problem Types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') CWE

Impacts

Potential arbitrary JavaScript execution