[ CVE-2016-20098 · Published 9 Oct 2026 ]
Vulnerability in toolbox-team reddit-moderator-toolbox
CVSS 5.4
EPSS <1%No fix listed yet
[ Description ]Official description
Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vulnerability in the removalreasons module, which inserts subreddit toolbox wiki fields into popup HTML without encoding. Attackers who can edit the toolbox wiki page can plant JavaScript in fields like pmsubject, header, or reason titles to act with moderators' Reddit sessions.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.