# CVE-2026-55793: Craft CMS stored XSS in Structure entry title table view

Source: https://junglewise.ai/threats/cve-2026-55793-craft-cms-stored-xss-in-structure-entry-title-table-view  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-55793 · Severity: medium · CVSS 4 · Published 2026-07-01

A security vulnerability in Craft CMS allows a user with basic 'Author' permissions to take over administrative accounts. By saving a malicious script as an entry title, the attacker can trigger the script to run when an administrator interacts with that entry in the control panel. This can lead to the administrator's email address being changed, allowing the attacker to reset the password and gain full control of the site.

Technologies: [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-55793 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55793 being exploited in the wild.

**How severe is CVE-2026-55793?** Medium severity, with a CVSS score of 4, published 1 July 2026.

**Which products and versions are affected?** craftcms/cms (Packagist) >= 5.0.0-RC1, < 5.9.22, ECOSYSTEM:introduced=5.0.0-RC1,fixed=5.9.53.

**Is there a fix for CVE-2026-55793?** Yes. craftcms/cms (Packagist): upgrade to 5.9.53 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55793 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55793?** Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- craftcms/cms (Packagist): upgrade to 5.9.53 or later

  ```sh
  composer require craftcms/cms:^5.9.53
  ```


## Technical details

A stored XSS vulnerability exists in ElementTableSorter.js due to improper handling of entry titles in the 'Structure' table view. While the server escapes the title into a 'data-title' attribute, the client-side code retrieves this value using jQuery's .data() method (which decodes it) and then concatenates it into a new HTML string for an aria-label without further escaping. An attacker with 'createEntries' and 'saveEntries' permissions can inject a payload into a title. The payload executes when a victim with 'saveEntries' permissions (such as an admin) drags an entry to become a child of the poisoned entry. This can be leveraged for account takeover by performing actions like changing the victim's email address during an elevated session.

## Affected products

- Pixel & Tonic Craft CMS >= 5.0.0-RC1, < 5.9.22

## Identifiers

- CVE-2026-55793
- GHSA-xrqc-p465-2xvg

## Timeline

- 2026-06-16: disclosed: Initial disclosure to vendor
- 2026-07-01: advisory: NVD publication date
- 2026-07-06: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/Crypto-Cat](https://api.github.com/users/Crypto-Cat)
- [https://github.com/Crypto-Cat](https://github.com/Crypto-Cat)
- [https://api.github.com/users/Crypto-Cat/gists%7B/gist_id%7D](https://api.github.com/users/Crypto-Cat/gists%7B/gist_id%7D)
- [https://api.github.com/users/Crypto-Cat/repos](https://api.github.com/users/Crypto-Cat/repos)
- [https://avatars.githubusercontent.com/u/12751872?v=4](https://avatars.githubusercontent.com/u/12751872?v=4)
- [https://api.github.com/users/Crypto-Cat/events%7B/privacy%7D](https://api.github.com/users/Crypto-Cat/events%7B/privacy%7D)

## Related threats

- [Craft CMS: Stored XSS in the control panel via unescaped draft name](https://junglewise.ai/threats/cve-2026-72787-craft-cms-stored-xss-in-the-control-panel-via-unescaped-draft)
- [Craft CMS: Arbitrary user password reset leading to administrator account takeover](https://junglewise.ai/threats/cve-2026-72786-craft-cms-arbitrary-user-password-reset-leading-to-administrator)
- [Craft CMS authorization bypass in category structure modification](https://junglewise.ai/threats/craft-cms-authorization-bypass-in-category-structure-modification-1555f980)
- [Craft CMS authenticated RCE through Twig sandbox escape](https://junglewise.ai/threats/craft-cms-authenticated-rce-through-twig-sandbox-escape-32ee5ec1)
- [Craft CMS path traversal in ensurePathIsContained](https://junglewise.ai/threats/craft-cms-path-traversal-in-ensurepathiscontained-4adc3058)