CVE-2026-27126 — Cross-site Scripting in Craft CMS

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
5.9MEDIUMNVD
EPSS
0.0%
top 98.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Craftcms Craft CMSCraftcms CMS
Timeline
PublishedFeb 24

Description

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `html` column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. In order to exploit the vulnerability, an attacker must have an administrator account, and `allow…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Packages3 packages

▶Packagistcraftcms/cms4.5.0-RC1 — 4.16.19+1
▶NVDcraftcms/craft_cms< 4.16.19+3
▶CVEListV5craftcms/cms>= 4.5.0-RC1, < 4.16.19, >= 5.0.0-RC1, < 5.8.23+1

Patches

Patch: github.com ↗

🔴Vulnerability Details

3
CVEList
Craft CMS has Stored XSS in Table Field via "HTML" Column Type↗2026-02-24
▶
OSV
Craft CMS has Stored XSS in Table Field via "HTML" Column Type↗2026-02-23
▶
GHSA
Craft CMS has Stored XSS in Table Field via "HTML" Column Type↗2026-02-23
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-27126 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-27126 — Cross-site Scripting in Craft CMS | cvebase