# CVE-2020-27666: Strapi stored XSS in WYSIWYG editor preview

Source: https://junglewise.ai/threats/cve-2020-27666-strapi-stored-xss-in-wysiwyg-editor-preview  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-10-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-27666 · Severity: low · CVSS 3.1 · Published 2020-10-29

Strapi is a popular open-source headless CMS used to manage and deliver content to web and mobile applications. A stored cross-site scripting (XSS) vulnerability in the WYSIWYG editor's preview feature allows authenticated users to inject malicious scripts that persist in the database and execute in the browsers of other users viewing the content, potentially leading to unauthorized data access or account compromise.

Technologies: [@strapi/plugin-content-manager (npm)](https://junglewise.ai/threats/technologies/strapi-plugin-content-manager). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-27666 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-27666 being exploited in the wild.

**How severe is CVE-2020-27666?** Low severity, with a CVSS score of 3.1, published 29 October 2020.

**Which products and versions are affected?** @strapi/plugin-content-manager (npm) SEMVER:introduced=0,fixed=3.2.5.

**Is there a fix for CVE-2020-27666?** Yes. @strapi/plugin-content-manager (npm): upgrade to 3.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-27666 attacked?** It is attacked over the network.

**Am I affected by CVE-2020-27666?** Check whether you run @strapi/plugin-content-manager (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @strapi/plugin-content-manager (npm): upgrade to 3.2.5 or later

  ```sh
  npm install @strapi/plugin-content-manager@3.2.5
  ```


## Technical details

This is a stored XSS vulnerability (CWE-79) in the WYSIWYG editor's preview functionality of Strapi versions prior to 3.2.5. The vulnerability exists in the strapi-plugin-content-manager package, where user input is not properly sanitized before being displayed in the preview feature. An authenticated user can inject malicious JavaScript code through the editor, which is then stored in the database and executed in the browsers of other users who view the affected content. The attack requires a valid user account (login required) and user interaction to view the preview. The vulnerability was patched in version 3.2.5 via a security fix to properly sanitize preview output.

## Affected products

- Strapi strapi-plugin-content-manager before 3.2.5

## Identifiers

- CVE-2020-27666
- GHSA-qvp5-mm7v-4f36

## Timeline

- 2020-10-29: disclosed
- 2020-10-22: patched: Fix merged in PR #8440

## References

- [https://github.com/strapi/strapi/pull/8440](https://github.com/strapi/strapi/pull/8440)

## Related threats

- [Strapi Content Manager data disclosure via relations in admin panel](https://junglewise.ai/threats/cve-2024-29181-strapi-content-manager-data-disclosure-via-relations-in-admin)
- [Strapi field level permissions bypass in relationship title](https://junglewise.ai/threats/cve-2023-37263-strapi-field-level-permissions-bypass-in-relationship-title)
- [Strapi information disclosure in content-manager relations view](https://junglewise.ai/threats/cve-2023-36472-strapi-information-disclosure-in-content-manager-relations-view)