Medium

Stored XSS in Foxit PDF Editor Cloud Create New Layer Feature

IdentifiersCVE-2026-1592CWE-79· Improper Neutralization of Input…

CVE-2026-1592 is a stored cross-site scripting vulnerability in Foxit PDF Editor Cloud (pdfonline.foxit.com) affecting the Create New Layer feature. The application embeds unsanitized user-supplied layer data into generated HTML without sufficient sanitization or output encoding. As a result, attacker-controlled content stored in a layer name or related layer field can be rendered and executed as arbitrary JavaScript when the malicious layer is later referenced or viewed. The issue affects Foxit PDF Editor Cloud versions before the 2026-02-03 fix.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows arbitrary JavaScript execution in the victim user’s browser within the Foxit PDF Editor Cloud application context. This can enable session hijacking, access to sensitive document data available to the victim, execution of unauthorized actions on the victim’s behalf, redirection to attacker-controlled content, and potentially account compromise depending on the victim’s privileges and available session context.

Mitigation

If you can’t patch tonight, do this now.

Until remediation is confirmed, restrict or disable use of the Create New Layer feature where operationally feasible, limit access to pdfonline.foxit.com to trusted users, and monitor for suspicious or anomalous layer names and unexpected client-side behavior. Additional browser-side hardening such as a strict Content Security Policy may reduce exploitability if supported by the deployment model, but it is not a substitute for patching.

Remediation

Patch, then assume compromise.

Update Foxit PDF Editor Cloud to the vendor-fixed version released on or after 2026-02-03. The fix should include proper server- and client-side input validation, contextual output encoding, and sanitization for layer-related fields used by the Create New Layer feature before insertion into HTML. Organizations should verify the cloud service is running the patched build and retest the feature for stored XSS behavior.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Foxit SoftwareFoxit Pdf Editor Cloud (Pdfonline)application

Foxit SoftwarePdf Editor Cloudapplication

Foxit SoftwarePdf Editor Cloud (Pdfonline)application

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

12 SOURCESView more in app

cyber security newsNews

Feb 18, 2026

16 Zero-Day Vulnerabilities in Popular PDF Platforms Enable Code Execution and Data Exfiltration

A medium-severity stored XSS vulnerability in Foxit’s Create New Layer field.

the hacker newsNews

Feb 9, 2026

⚡ Weekly Recap: AI Skill Malware, 31Tbps DDoS, Notepad++ Hack, LLM Backdoors and More

Unknown (listed as a trending CVE affecting Foxit PDF Editor Cloud; no technical details provided in the content).

the hacker newsNews

Feb 9, 2026

⚡ Weekly Recap: AI Skill Malware, 31Tbps DDoS, Notepad++ Hack, LLM Backdoors and More

Unknown (listed as a trending CVE affecting Foxit PDF Editor Cloud; no technical details provided in the content).

the hacker newsNews

Feb 9, 2026

⚡ Weekly Recap: AI Skill Malware, 31Tbps DDoS, Notepad++ Hack, LLM Backdoors and More

Unknown (listed as a trending CVE affecting Foxit PDF Editor Cloud; no technical details provided in the content).

+5 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-1592

NVD

nvd.nist.gov/vuln/detail/CVE-2026-1592

MITRE CWE · CWE-79

Improper Neutralization of Input During Web…

Vendor Advisory

foxit.com/support/security-bulletins.html