MEDIUM 5.1 NVD
CVE-2026-72787
Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding i
Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browser of any higher-privileged user viewing the affected element, allowing account creation and other authenticated actions.
References
- https://github.com/craftcms/cms/security/advisories/GHSA-2rp4-x2j7-qmcc
- https://www.vulncheck.com/advisories/craft-cms-rc1-before-stored-xss-via-draft-name
This medium severity vulnerability with a CVSS score of 5.1 was published on 2026-08-12 via NVD.
vulnfeed aggregates 10542 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.