Vulnerabilities
CVE-2026-26862 - CleverTap Web SDK DOM-Based XSS
CVE ID : CVE-2026-26862 Published : Feb. 27, 2026, 6:16 p.m. | 14 minutes ago Description : CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder module. The origin validation in src/modules/visualBuilder/pageBuilder.js (lines 56-60) uses the includes() method to verify the originUrl contains