Vulnerabilities

TI-2026-21400 CVE-2026-26862 · GHSA-jfrq-hj9f-c8qx

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site…

HIGH 69

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder module.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00422 Published 2026-02-27 Fixed in 1.15.3 CWE-79

TI-2026-21399 CVE-2026-26861 · GHSA-j5mf-6rh3-rhgg

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS)…

HIGH 69

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00205 Published 2026-02-27 Fixed in 1.15.3 CWE-346

TI-2023-02351 CVE-2023-2507 · GHSA-x2ph-qqwm-9cc6

CleverTap Cordova Plugin 2.6.2 - Reflected XSS

HIGH 75

CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00855 Published 2023-07-15 Fixed in 2.7.0 CWE-79

Vulnerabilities

Filters

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site…

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS)…

CleverTap Cordova Plugin 2.6.2 - Reflected XSS