CVE-2026-70588

MEDIUM 5.0

Ghost: Cross-Site Scripting in Universal Import

CVSS Score

5.0

EPSS Score

0.0%

EPSS Percentile

0th

Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1.

CWE	CWE-79
Vendor	tryghost
Product	ghost
Published	Aug 4, 2026

Stay Ahead of the Next One

Get instant alerts for tryghost ghost

Be the first to know when new medium vulnerabilities affecting tryghost ghost are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Affected Versions

TryGhost / Ghost

>= 5.26.0, < 6.54.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/TryGhost/Ghost/security/advisories/GHSA-2gx6-7gx2-wwcf github.com: https://github.com/TryGhost/Ghost/pull/29635 github.com: https://github.com/TryGhost/Ghost/commit/a8bea3a4ceec4c852b880f4885119453c3d8588e github.com: https://github.com/TryGhost/Ghost/releases/tag/v6.54.1