Stored XSS Vulnerability in Edito CMS by Edito
CVE-2026-59077

5.1MEDIUM

Key Information:

Vendor

Edito

Status
Edito Cms
Vendor
CVE Published:
13 November 2026

What is CVE-2026-59077?

Edito CMS has a vulnerability that allows authenticated attackers to execute arbitrary HTML and JavaScript code through the content parameter in the Tiny editor. This can lead to substantial risks, as the injected scripts will be executed whenever a user edits the affected entry, potentially compromising user data and site integrity. The issue has been addressed in version 5.10.2607, along with hotfixes for older versions including 5.8 to mitigate the risk.

Affected Version(s)

Edito CMS 0 < 5.10.2607

References

https://cert.pl/posts/2026/11/CVE-2026-59074
third-party-advisory
https://www.edito.pl/
product

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE Team)
Dawid Małecki (AFINE Team)
​Paweł Zdunek (AFINE Team)
.