CVE-2026-84793
Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name
- State
- Published
- Severity
- 4.8 Medium
- Published
- Sep 2, 2026
- Updated
- Sep 2, 2026
- Reserved
- Sep 2, 2026
Description
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 4.8 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
cmscraftcms |
|
References
- GitHub Security Advisory (GHSA-5fjj-496j-2qqf)vendor-advisory
- VulnCheck Advisory: Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site namethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.