Ddjango-cms

Products

Exploited and recent CVEs

• CVE-2026-75526 Medium 4.4 django CMS: Stored XSS in edit-mode plugin exception rendering 0.3%
• CVE-2026-63003 Medium 6.5 django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass) 0.4%
• CVE-2026-61663 Medium 4.3 django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff 0.3%
• CVE-2026-54622 Medium 6.5 django CMS: Clipboard copy IDOR discloses unauthorized plugin content 0.4%
• CVE-2026-54624 Medium 6.5 django CMS: Structure endpoint bypasses page-view permission 0.4%
• CVE-2026-54623 High 7.1 django CMS: Plugin move endpoint allows cyclic reparenting (DoS) 0.5%
• CVE-2026-54625 Medium 4.8 django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning) 0.2%