Vulnerability · Published Sep 2, 2026 · Assigned by VulnCheck
CVE-2026-84793Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name
Medium 4.8
In plain English
A medium-severity cross-site scripting in cms from craftcms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.3%top 83.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
References
- GitHub Security Advisory (GHSA-5fjj-496j-2qqf) vendor-advisory
- VulnCheck Advisory: Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name third-party-advisory