CVE-2026-32754 Stored XSS in Email Notification Templates

CVE-2026-32754 is a high-severity vulnerability. AttackerView checks FreeScout sites for it with a live exploit check.

Is my site vulnerable to CVE-2026-32754?

Detects FreeScout instances running version 1.8.208 or earlier where incoming email bodies are rendered in agent notification emails without sanitization. Attackers can send crafted emails to any FreeScout-monitored inbox to inject JavaScript that executes when agents view the notification, enabling session hijacking and account takeover.