XSS Vulnerability in Payload CMS Admin Panel Affects Users
CVE-2026-34748

8.7HIGH

Key Information:

Vendor

Payloadcms

Status
Payload
Vendor
CVE Published:
1 April 2026

What is CVE-2026-34748?

A stored Cross-Site Scripting (XSS) vulnerability was identified in the admin panel of Payload, a free and open-source headless content management system. This vulnerability allows an authenticated user with write access to a collection to save malicious content that, when viewed by another user, executes arbitrary scripts in their browser. This issue has been resolved in version 3.78.0, emphasizing the importance of regular updates to safeguard against such threats.

Affected Version(s)

payload < 3.78.0

References

https://github.com/payloadcms/payload/security/advisories...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.