Is CVE-2026-92590 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92590 being exploited in the wild.

How severe is CVE-2026-92590?

Medium severity, with a CVSS score of 5.4, published 16 September 2026.

Which products and versions are affected?

Craft CMS 5.7.0 before 5.10.13.

Is there a fix for CVE-2026-92590?

A patch was published on 2026-09-16: Version 5.10.13 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92590 attacked?

It is attacked over the network.

Am I affected by CVE-2026-92590?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92590: Craft CMS stored cross-site scripting in Generated Fields

CVE-2026-92590 · Severity: medium · CVSS 5.4 · Published 2026-09-16

Craft CMS is a content management system used by organizations to manage web content and editorial workflows. A stored XSS vulnerability in the Generated Fields feature allows low-privilege content editors to inject malicious JavaScript that executes in the authenticated Control Panel sessions of higher-privileged administrators and other users viewing content indexes. This privilege escalation could lead to unauthorized actions, data theft, or further system compromise performed under an administrator's authority.

Quick answers

Is CVE-2026-92590 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92590 being exploited in the wild.
How severe is CVE-2026-92590?: Medium severity, with a CVSS score of 5.4, published 16 September 2026.
Which products and versions are affected?: Craft CMS 5.7.0 before 5.10.13.
Is there a fix for CVE-2026-92590?: A patch was published on 2026-09-16: Version 5.10.13 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92590 attacked?: It is attacked over the network.
Am I affected by CVE-2026-92590?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (CWE-79) in Craft CMS's Generated Fields feature, which renders admin-authored Twig templates to compute display values for elements. The root cause is that the rendering process explicitly disables Twig autoescaping and the display paths (Table and Card views) fail to apply HTML encoding to cached values. An attacker with content editor privileges can inject HTML/JavaScript payloads into editable fields referenced by the Twig template; when higher-privileged users (including administrators) view the element index, the stored payload executes in their authenticated session. The attack vector is network-based and requires authentication (content editor access) and user interaction (admin viewing the index). The vulnerability affects Craft CMS versions 5.7.0 through 5.10.12; patch 5.10.13 is available.

Affected products

Craft CMS 5.7.0 before 5.10.13

Timeline

2026-09-16: disclosed
2026-09-16: patched: Version 5.10.13 available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.