Stored Cross-Site Scripting Vulnerability in Ghost by TryGhost

CVE-2026-104414

What is CVE-2026-104414?

Ghost versions from 2.5.0 up to 6.63.0 are susceptible to a stored cross-site scripting issue that enables attackers to inject malicious scripts into post content via embedded oEmbed photo responses. Malicious entities can exploit this vulnerability by hosting harmful oEmbed photo content that, once embedded, can execute scripts within the Ghost editor, on published sites, and in newsletter emails. This compromises the integrity of admin sessions and can pose a significant threat to user data and site security.

References