Wix vulnerabilities

Products

• jam 1
• web application 1
• wix embedded mysql 1

Latest Wix CVEs

Newest publication first

1. CVE-2026-2276 Reflected Cross-Site Scripting in the Wix web application

   Published 2026-02-12

   Medium·CVSS 5.3 EPSS 0.42%

   Reflected Cross-Site Scripting (XSS) vulnerability in the Wix web application, where the endpoint ' https://manage.wix.com/account/account-settings ', responsible for uploading SVG images, does not properly sanitize the content. An authenticated attacker could upload an SVG file...

2. CVE-2025-3841 wix-incubator jam Jinja2 Template jam.py special elements used in a template engine

   Published 2025-04-21

   Medium·CVSS 4.8 EPSS 0.45%

   A vulnerability, which was classified as problematic, was found in wix-incubator jam up to e87a6fd85cf8fb5ff37b62b2d68f917219d07ae9. This affects an unknown part of the file jam.py of the component Jinja2 Template Handler. The manipulation of the argument config['template'] leads...

3. CVE-2023-39021 Code injection in wix-embedded-mysql

   Published 2023-07-28

   Critical·CVSS 9.8 EPSS 1.0%

   wix-embedded-mysql v4.6.1 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.Setup.apply. This vulnerability is exploited via passing an unchecked argument.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.