XSS in Craftcms Cms

CVE-2026-55790

Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin use…

Vulnerability class: XSS (Cross-Site Scripting)

Affected products

  • Craftcms Cms — versions >= 5.0.0-RC1, < 5.9.23, >= 4.0.0-RC1, < 4.17.16

Weakness classification (CWE)

References