XSS in Craftcms Cms
CVE-2026-33051
Craft CMS is a content management system (CMS). In versions 5.9.0-beta.1 through 5.9.10, the revision/draft context menu in the element editor renders the creator’s fullName as raw HTML due to the use of Template::raw() combined with Craft::t() string interpolation. A low-privileged control panel user (e.g., Author) can set their fullName to an XSS payload via the profile editor, then create an entry with two saves. If an administrator is logged in and executes a specifically crafted payload while an elevated session is active, the attacker’s account can be elevated to administrator. This issue has been fixed in version 5.9.11.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (20.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 20th percentile — 20.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001
Affected products
- Craftcms Cms — versions >= 5.9.0-beta.1, < 5.9.11
- Craftcms Craft Cms
Weakness classification (CWE)
References
- github.com/craftcms/cms/security/advisories/GHSA-3x4w-mxpf-fhqq (Patch, Vendor Advisory)
- github.com/craftcms/cms/commit/f634a9d21edcafd83a6716047d275f985aba6be1 (Patch)
- github.com/craftcms/cms/releases/tag/5.9.11 (Product, Release Notes)
Frequently asked questions
- What is CVE-2026-33051?
- CVE-2026-33051 is a medium-severity vulnerability in Craftcms Cms, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-03-20.
- How severe is CVE-2026-33051?
- Medium severity. CVSS v3 base score is 5.4 out of 10.