CVE-2026-42157 | defend.network

What is CVE-2026-42157?

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, a remote attacker can create a map node with a malicious label that contains arbitrary HTML. When the map tab is selected and a map node marker is selected, it will render the arbitrary HTML, potentially triggering stored XSS. This vulnerability is fixed in 1.2.3.

CVSSawaiting NVD

ExploitationNo exploitation reported

EPSS<1% · P20

Triage statusUnder Review

ActionSchedule for next cycle

NVD published2026-05-12

NVD last modified2026-06-17

Timeline

2026-05-12Published to the U.S. National Vulnerability Database (NVD)
2026-06-17NVD record last updated

Affected product

See advisory

Remediation Steps

Update Avada Builder plugin to patched version immediately on all 1M+ affected installations
Audit database for unauthorized data extraction via arbitrary file read vulnerability
Restrict file read permissions in WordPress configuration to essential directories only
Review user database for suspicious account creation or privilege changes
Implement WordPress security hardening including input sanitization on all custom fields

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 3 of May 2026 (May 18 – 24)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.