Stored Cross-Site Scripting in Craft CMS by Craft

CVE-2026-92590

What is CVE-2026-92590?

Craft CMS versions from 5.7.0 to 5.10.12 are vulnerable to a stored cross-site scripting issue in the Generated Fields feature. The vulnerability arises due to the disabling of Twig autoescaping, which results in cached values not being properly encoded. As a consequence, content editors can exploit this flaw to inject malicious JavaScript code through editable fields, which executes within the authenticated Control Panel sessions of higher-privileged users when they access element indexes. This poses significant risks to the security of user data and system integrity.

References