CVE-2026-84793 Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name
Administrators can inject JavaScript into the site name field, leading to stored XSS execution for other users viewing control panel settings.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-84793?
CVE-2026-84793 is a medium-severity cross-site scripting vulnerability in craftcms cms, published on 2 Sep 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages.
Weakness: CWE-79
Which versions are affected by CVE-2026-84793?
How do I fix CVE-2026-84793?
No fix has been published for CVE-2026-84793 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-84793 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-84793 exists.
Sources
Also known as GHSA-5fjj-496j-2qqf, GHSA-wf9j-59pf-vfvj.