CVE-2026-59076
Stored XSS in Edito CMS
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Edito CMS is vulnerable to Stored Cross-Site Scripting (XSS). Due to improper input validation, an authenticated attacker can inject malicious scripts into givenName and surname parameters via the /api/auth/profile endpoint. When an administrator visits the admin changelog logs, the injected script is automatically executed, in his browser. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.
| CWE | CWE-79 |
| Vendor | edito |
| Product | edito cms |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for edito edito cms
Be the first to know when new unknown vulnerabilities affecting edito edito cms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Edito / Edito CMS
0 < 5.10.2607
References
Credits
Michał Majchrowicz (AFINE Team) Dawid Małecki (AFINE Team) Paweł Zdunek (AFINE Team)