CVE-2026-45011
published 2026-06-12CVE-2026-45011: ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross-site scripting vulnerability in the image widget…
PriorityP339high7.3CVSS 3.1
AVNACLPRLUIRSUCHIHAN
EPSS
0.21%
11.4th percentile
ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross-site scripting vulnerability in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload. Because editors have permission to publish pages, the malicious widget can be published to the live site. When another user, including an administrator or public visitor, clicks the affected image/link, arbitrary JavaScript executes in the victim’s browser. As of time of publication, no known patched versions are available.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apostrophecms | apostrophe | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
apostrophecms apostrophe 4.29.0 cross site scripting (GHSA-5f64-7vfc-rcx6)
vuldb·2026-06-13·CVSS 7.3
CVE-2026-45011 [HIGH] apostrophecms apostrophe 4.29.0 cross site scripting (GHSA-5f64-7vfc-rcx6)
A vulnerability was found in apostrophecms apostrophe 4.29.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross site scripting.
This vulnerability is registered as CVE-2026-45011. It is possible to launch the attack remotely. No exploit is available.
GHSA
Apostrophe has stored XSS via javascript: URL in Image Widget Link
ghsa·2026-05-14
CVE-2026-45011 [HIGH] CWE-116 Apostrophe has stored XSS via javascript: URL in Image Widget Link
Apostrophe has stored XSS via javascript: URL in Image Widget Link
### Summary
A stored cross-site scripting vulnerability was identified in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload.
Because editors have permission to publish pages, the malicious widget can be published to the live site. When another user, including an administrator or public visitor, clicks the affected image/link, arbitrary JavaScript executes in the victim’s browser.
### Affected Version
ApostropheCMS (tested on version: v4.29.0)
### Steps to Reproduce
**Precondition**
Ensure at least one image exists in the media library.
If the media library is empty:
- Log in as an Editor.
- Open the media library.
- Upload any JPG or PNG imag
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-12
Published