Cross-Site Scripting Vulnerability in django CMS by Django

CVE-2026-75526

What is CVE-2026-75526?

A vulnerability in django CMS allows an attacker to execute stored malicious HTML in an administrator's browser. This occurs when the ContentRenderer renders plugin errors in edit mode, using raw values that can include harmful scripts. If these values are not escaped properly, they may lead to unauthorized actions. This issue, identified in versions 5.0.8 and 5.0.9, can be mitigated by upgrading to the fixed version 5.0.9 where appropriate sanitization is implemented using format_html.

References