Executive brief
Craft CMS, a popular content management platform, contains a stored cross-site scripting vulnerability in the site name field where administrator input is not properly sanitized. An authenticated administrator can inject malicious JavaScript that will execute when other users access the control panel settings pages, potentially leading to account compromise or unauthorized actions performed in the context of other users' sessions.
Technical details
A stored cross-site scripting (CWE-79) vulnerability exists in Craft CMS where the site name field fails to properly escape output when rendered in the control panel. An attacker with administrator privileges and the allowAdminChanges permission enabled can inject arbitrary JavaScript payloads into the site name via Settings > Sites. The malicious script is stored in the database and executed in the browser of any user viewing the Settings > Email page or other control panel pages that render the site name. This requires administrator-level access and user interaction (victim must view an affected page), but once exploited can enable session hijacking, credential theft, or malicious actions performed on behalf of the victim. The vulnerability is patched in version 5.10.11 and later.
Affected products
- Craft CMS CMS 5.0.0-RC1 before 5.10.11
Timeline
- 2026-08-18: disclosed
- 2026-09-02: advisory
- 2026-09-02: patched: Version 5.10.11 and later