Vulnerability · Published Aug 20, 2026 · Assigned by GitHub_M
CVE-2026-75526django CMS: Stored XSS in edit-mode plugin exception rendering
Medium 4.4
In plain English
A medium-severity cross-site scripting in django-cms from django-cms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values to ContentRenderer.render_exception when plugin rendering fails in edit mode. Values from get_short_description(), the exception message, the placeholder, or placeholder.source are interpolated into a cms-rendering-exception heading and later returned through mark_safe. Because the heading is not escaped, stored HTML executes in an editor’s browser, and settings.DEBUG does not prevent the custom heading from rendering. The fix uses format_html to escape the message before safe placeholder output is returned. This issue is fixed in versions 5.0.9.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | django-cms | 5.0.9 | GHSA-hvq6-2r72-p2x7 |
| PyPI | django-cms | 5.0.9 | PYSEC-2026-3825 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| django-cms | django-cms | >= 5.0.8, < 5.0.9 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- https://github.com/django-cms/django-cms/security/advisories/GHSA-hvq6-2r72-p2x7 x_refsource_CONFIRM
- https://github.com/django-cms/django-cms/pull/8711 x_refsource_MISC
- https://github.com/django-cms/django-cms/commit/b56a568844ff3702495945f73a31d0868285bf88 x_refsource_MISC
- https://github.com/django-cms/django-cms/releases/tag/5.0.9 x_refsource_MISC