CVE-2026-56383
Craft CMS - Stored XSS in Table Field via Row Heading Column Type
CVSS Score
4.8
EPSS Score
0.0%
EPSS Percentile
0th
Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administrator account (with allowAdminChanges enabled) to inject arbitrary JavaScript that executes when another user views a page containing the affected table field. Affected versions are >= 4.5.0-beta.1 through 4.16.18 and >= 5.0.0-RC1 through 5.8.22; fixed in 4.16.19 and 5.8.23.
| CWE | CWE-79 |
| Vendor | craftcms |
| Product | cms |
| Published | Jun 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for craftcms cms
Be the first to know when new medium vulnerabilities affecting craftcms cms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
craftcms / cms
4.5.0-beta.1 < 4.16.19 5.0.0-RC1 < 5.8.23
References
Credits
🔍 mHe4am