CyberSecBulletin

CleverTap vulnerabilities

We track 2 vulnerabilities in CleverTap products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on February 27, 2026.

2vulnerabilities
0critical
2high
0exploited
8.3average CVSS score

Latest CleverTap vulnerabilities

  • 8.3 High severity

    Clevertap Web SDK: Improper Neutralization of Input During Web Page Generation

    CVE-2026-26862CleverTap

    CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder module. The origin validation in src/modules/visualBuilder/pageBuilder.js (lines 56-60) uses the includes() method t

  • 8.3 High severity

    Clevertap Web SDK: Origin Validation Error

    CVE-2026-26861CleverTap

    CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using the