CVE-2026-55793: Craft CMS stored XSS in Structure entry title table view

CVE-2026-55793 · Severity: medium · CVSS 4 · Published 2026-07-01

A security vulnerability in Craft CMS allows a user with basic 'Author' permissions to take over administrative accounts. By saving a malicious script as an entry title, the attacker can trigger the script to run when an administrator interacts with that entry in the control panel. This can lead to the administrator's email address being changed, allowing the attacker to reset the password and gain full control of the site.

Technologies: craftcms/cms (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-55793 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55793 being exploited in the wild.
How severe is CVE-2026-55793?
Medium severity, with a CVSS score of 4, published 1 July 2026.
Which products and versions are affected?
craftcms/cms (Packagist) >= 5.0.0-RC1, < 5.9.22, ECOSYSTEM:introduced=5.0.0-RC1,fixed=5.9.53.
Is there a fix for CVE-2026-55793?
Yes. craftcms/cms (Packagist): upgrade to 5.9.53 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55793 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-55793?
Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • craftcms/cms (Packagist): upgrade to 5.9.53 or later
    composer require craftcms/cms:^5.9.53

Technical details

A stored XSS vulnerability exists in ElementTableSorter.js due to improper handling of entry titles in the 'Structure' table view. While the server escapes the title into a 'data-title' attribute, the client-side code retrieves this value using jQuery's .data() method (which decodes it) and then concatenates it into a new HTML string for an aria-label without further escaping. An attacker with 'createEntries' and 'saveEntries' permissions can inject a payload into a title. The payload executes when a victim with 'saveEntries' permissions (such as an admin) drags an entry to become a child of the poisoned entry. This can be leveraged for account takeover by performing actions like changing the victim's email address during an elevated session.

Affected products

  • Pixel & Tonic Craft CMS >= 5.0.0-RC1, < 5.9.22

Identifiers

  • CVE-2026-55793
  • GHSA-xrqc-p465-2xvg

Timeline

  • 2026-06-16: disclosed: Initial disclosure to vendor
  • 2026-07-01: advisory: NVD publication date
  • 2026-07-06: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.