MEDIUM 4.8 NVD
CVE-2026-84793
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Admini
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages.
References
- https://github.com/craftcms/cms/security/advisories/GHSA-5fjj-496j-2qqf
- https://www.vulncheck.com/advisories/craft-cms-5.0.0-rc1-before-5.10.11-stored-xss-via-sit
- https://github.com/craftcms/cms/security/advisories/GHSA-5fjj-496j-2qqf
This medium severity vulnerability with a CVSS score of 4.8 was published on 2026-09-02 via NVD.
vulnfeed aggregates 11639 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.