CVE-2026-56383

Craft CMS - Stored XSS in Table Field via Row Heading Column Type

State: Published
Severity: 4.6 Medium
Published: Jun 21, 2026
Updated: Jun 23, 2026
Reserved: Jun 21, 2026

Description

Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administrator account (with allowAdminChanges enabled) to inject arbitrary JavaScript that executes when another user views a page containing the affected table field. Affected versions are >= 4.5.0-beta.1 through 4.16.18 and >= 5.0.0-RC1 through 5.8.22; fixed in 4.16.19 and 5.8.23.

Scores

CVSS	Score	Vector	Source
4.0	4.6 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N	VulnCheck
3.1	4.8 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	VulnCheck

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
cmscraftcms	4.5.0-beta.1 to before 4.16.19Affected 4.16.19Not affected 5.0.0-RC1 to before 5.8.23Affected 5.8.23Not affected

References

GHSA Advisory GHSA-6j87-m5qx-9fqpvendor-advisory
https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5apatch
VulnCheck Advisory: Craft CMS - Stored XSS in Table Field via Row Heading Column Typethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.