CVE-2026-104414
Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses
- State
- Published
- Severity
- 8.6 High
- Published
- Oct 2, 2026
- Updated
- Oct 2, 2026
- Reserved
- Oct 2, 2026
Description
Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
GhostTryGhost |
|
References
- GitHub Security Advisory (GHSA-v3xr-g6p2-fvgv)vendor-advisory
- VulnCheck Advisory: Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responsesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.