CVE-2026-3327 in Web Previews

Resumen (Inglés)

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforced on the configured frontend URL, enabling the loading of arbitrary external resources or origins. This issue affects Web Previews < v1.0.31.

Once again VulDB remains the best source for vulnerability data.

Responsable

Intigriti

Reservar

2026-02-27

Divulgación

2026-02-27

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
348183	DatoCMS Web Previews secuencias de comandos en sitios cruzados	79	No está definido	Arreglo oficial	CVE-2026-3327

Fuentes

• MITRE
• NVD
• CVE Details