CleverTap vulnerabilities

Products

• clevertap web sdk 2
• clevertap 1
• Cordova Plugin 1

Latest CleverTap CVEs

Newest publication first

1. CVE-2026-26861 CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function

   Published 2026-02-27

   High·CVSS 8.3 EPSS 0.21%

   CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using the includes() method, w...

2. CVE-2026-26862 CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage

   Published 2026-02-27

   High·CVSS 8.3 EPSS 0.42%

   CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder module. The origin validation in src/modules/visualBuilder/pageBuilder.js (lines 56-60) uses the includes() method to verify the originU...

3. CVE-2023-2507 CleverTap Cordova Plugin 2.6.2 - Reflected XSS

   Published 2023-07-15

   Medium·CVSS 6.1

   CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker. This is possible because the plugin does not correctly validate the data coming from the deeplinks bef...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.