Vulnerability · Published Sep 13, 2026 · Assigned by VulnCheck

CVE-2026-90561Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG

High 8.7

In plain English

A high-severity cross-site scripting in strapi from strapi. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)8.7High

Exploit odds (30 days)0.4%top 62.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an Editor or Super Admin's session when the preview pane is expanded, enabling account takeover.

Affected products (as reported)

Vendor	Product	Versions
strapi	strapi	4.0.0 – through 4.26.25.0.0 – before 5.48.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

References

GitHub Issue #26857 issue-tracking
https://github.com/strapi/strapi product
https://github.com/strapi/strapi/blob/v5.46.0/packages/core/content-manager/admin/src/pages/EditView/components/FormInputs/Wysiwyg/PreviewWysiwyg.tsx technical-description
https://github.com/strapi/strapi/commit/875752612c30f951546904a29469e51e17e0ac37 patch
VulnCheck Advisory: Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG third-party-advisory