CVE-2026-26862 – CleverTap Web SDK DOM-Based XSS

CVE ID : CVE-2026-26862

Published : Feb. 27, 2026, 6:16 p.m. | 56 minutes ago

Description : CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder module. The origin validation in src/modules/visualBuilder/pageBuilder.js (lines 56-60) uses the includes() method to verify the originUrl contains “dashboard.clevertap.com”, which can be bypassed by an attacker using a crafted subdomain

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…