XSS in Apostrophecms Apostrophe

CVE-2026-45014

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 are vulnerable to stored cross-site scripting via unsanitized user display name in draft version tooltip. As of time of publication, no…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (20.8th percentile) — read the EPSS interpretation.