CVE-2026-57337: Unauthenticated XSS in Landing Page Builder ≤1.5.3.5 – Patch Guidance

Technical summary

This is a reflected or stored XSS vulnerability (CWE-79) in Landing Page Builder affecting all versions up to 1.5.3.5. The application fails to properly sanitize or encode user input before rendering it in the browser context. Because the vulnerability requires no authentication (PR:N) and network access is sufficient for exploitation (AV:N), an unauthenticated attacker can craft a malicious URL or inject code via landing page creation features. The impact spans confidentiality, integrity, and availability due to the cross-site context (S:C), allowing attackers to access sensitive data, modify page content, and disrupt service availability.

Business impact

Organizations relying on Landing Page Builder for marketing campaigns, lead generation, or customer engagement face direct risk to their brand reputation and customer trust. If an attacker injects malicious scripts into landing pages, visitors may be redirected to phishing sites, infected with malware, or have their session cookies stolen. This can result in data breaches, financial loss, regulatory compliance violations (GDPR, CCPA), and diminished user confidence. The vulnerability is particularly dangerous in multi-tenant or agency environments where a single compromise affects all downstream customers using that instance.

Affected systems

Landing Page Builder versions 1.5.3.5 and earlier are vulnerable. Organizations must audit their deployments to confirm the exact version in use. The advisory does not specify later versions as patched; verify the vendor's security advisory or release notes to confirm when a fix was released. If your organization uses Landing Page Builder for any customer-facing or internal purpose, assume you are at risk until patching is confirmed.

Exploitability

This vulnerability has a low attack complexity (AC:L) and requires only user interaction (UI:R), making it highly exploitable in real-world scenarios. An attacker can craft a URL or social engineer users into visiting a compromised landing page. No special tools or deep technical knowledge is required; basic XSS payloads suffice. The vulnerability is not yet listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, but the combination of ease of exploitation and high impact makes it attractive to threat actors. Exploitation can occur at scale via email campaigns or malicious advertisements.

Remediation

Immediately upgrade Landing Page Builder to a version later than 1.5.3.5. Verify the specific patch version against the vendor's official security advisory to ensure the fix addresses this XSS vulnerability. If an upgrade is not immediately available, implement input validation and output encoding controls at the application or web application firewall (WAF) level to block XSS payloads. Review landing page content for signs of unauthorized script injection. For critical deployments, consider disabling the application until a patch is confirmed available.

Patch guidance

Check the vendor's official release notes and security advisories for the first patched version after 1.5.3.5. Apply patches immediately to all instances of Landing Page Builder, including development, staging, and production environments. Verify the patch removes the XSS vulnerability by reviewing the changelog or advisory details. If you are unsure of your current version, run a version detection command or check the admin panel settings. Test the patched version thoroughly in a non-production environment before rolling out to production. Document the patch date and version for compliance and audit purposes.

Detection guidance

Monitor web server and application logs for suspicious query parameters or POST payloads containing script tags, event handlers (onclick, onerror, onload), or encoded XSS patterns such as %3Cscript%3E or \u003cscript\u003e. Use a Web Application Firewall (WAF) to detect and block common XSS payloads. Conduct code review or static analysis to identify unescaped output in templates or dynamic content generation. Perform manual testing by injecting benign XSS payloads (e.g., <img src=x onerror=alert(1)>) into user input fields to confirm whether sanitization is in place. Track any changes to landing page content that appear unauthorized or anomalous.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (7.1), unauthenticated attack vector, low complexity, and direct impact on user data and trust. The cross-site scope means a single compromised instance can affect all visitors to a landing page. The lack of KEV status does not diminish risk; it reflects newness rather than low threat level. Organizations should treat this as a priority patch within 24–48 hours, especially if Landing Page Builder is customer-facing or handles sensitive data collection.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects the combination of network accessibility (AV:N), no authentication required (PR:N), low attack complexity (AC:L), user interaction (UI:R), and impact to confidentiality, integrity, and availability across site boundaries (S:C with C:L, I:L, A:L). While individual impacts are rated as low, the breadth of affected users and the ease of exploitation elevate the overall severity to HIGH. This is a classic, high-impact XSS scenario.

Frequently asked questions