HIGH 8.6 NVD
CVE-2026-104414
Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmb
Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.
References
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-v3xr-g6p2-fvgv
- https://www.vulncheck.com/advisories/ghost-from-2.5.0-before-6.64.0-stored-xss-via-oembed-
This high severity vulnerability with a CVSS score of 8.6 was published on 2026-10-02 via NVD.
vulnfeed aggregates 10476 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.