CVE-2026-28116: Stored XSS in Emilia Projects Progress Planner 1.9.0 and Earlier

Technical summary

CVE-2026-28116 is a stored XSS vulnerability (CWE-79) in Progress Planner arising from improper input sanitization during web page generation. The vulnerability requires high-privilege authentication (administrator role) and user interaction to exploit. The attack vector is network-based with low attack complexity. The vulnerability affects confidentiality, integrity, and availability with limited scope, resulting in a CVSS 3.1 score of 5.9 (Medium severity).

Business impact

This vulnerability primarily threatens organizations using Progress Planner where administrative accounts may be compromised or where insider threats exist. Successful exploitation could lead to unauthorized data exposure, modification of project data, or disruption of planning workflows. The requirement for high-privilege access limits the immediate risk surface, but compromised admin credentials represent a material attack path. Organizations should evaluate whether their access controls and administrative monitoring adequately detect such attacks.

Affected systems

Progress Planner versions from the earliest tracked version through 1.9.0 are affected by this vulnerability. Organizations running Progress Planner should audit their deployment versions immediately. The vendor has not released information on patch availability at this time; consult the official Emilia Projects advisory for the latest remediation status.

Exploitability

Exploitation requires administrator-level access to the Progress Planner application and user interaction (such as a victim visiting an affected page). While the network attack surface is broad, the high-privilege requirement significantly constrains real-world attack scenarios. This is not an unauthenticated remote code execution vulnerability. Threat actors would need either stolen admin credentials or insider cooperation to mount an attack.

Remediation

First, identify all Progress Planner instances in your environment and determine their version numbers. Verify patch availability from Emilia Projects. If a patch exists for versions above 1.9.0, upgrade as soon as possible. If no patch is available, implement compensating controls: restrict administrative access to trusted networks only, enable detailed audit logging of administrative actions, and monitor for unusual script injection patterns in application logs.

Patch guidance

Verify the latest patch status directly with Emilia Projects. Organizations should prepare upgrade testing in a staging environment before production deployment. Given the stored XSS nature, a patched version should be treated as high-priority after release. Ensure administrative accounts are reviewed for unauthorized modifications prior to patching, as injected scripts may have already been deployed.

Detection guidance

Monitor Progress Planner application logs for suspicious script tags or encoded payloads in user input fields and saved project data. Look for unusual administrative account activity, particularly creation or modification of project elements containing JavaScript or HTML markup. Network-based detection should focus on identifying access to Progress Planner from unexpected administrative locations or at unusual times. Query the application's data store for common XSS payloads in stored fields if direct logging is unavailable.

Why prioritize this

Although rated CVSS 5.9 (Medium), this vulnerability warrants prompt remediation because stored XSS in administrative interfaces can serve as a persistence mechanism for attackers. The requirement for high-privilege access means this is lower priority than remote unauthenticated vulnerabilities, but the potential for lateral movement and data exfiltration justifies treating it as a near-term fix. Organizations should prioritize this within their medium-severity queue, particularly if they have identified historical admin account compromises.

Risk score, explained

The CVSS 5.9 score reflects the combination of network accessibility, low attack complexity, but high-privilege requirement and required user interaction. While the scope is changed (cross-context impact is possible), the confidentiality, integrity, and availability impacts are individually classified as low. The stored nature of the XSS elevates risk compared to reflected variants, as the attack persists and affects multiple users over time.

Frequently asked questions