CVE-2026-70596

MEDIUM 4.3

Ghost: Cross-Site Scripting in Feature Image Captions

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in feature_image_caption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is fixed in 6.54.1.

CWE	CWE-79
Vendor	tryghost
Product	ghost
Published	Aug 5, 2026
Last Updated	Aug 5, 2026

Stay Ahead of the Next One

Get instant alerts for tryghost ghost

Be the first to know when new medium vulnerabilities affecting tryghost ghost are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Affected Versions

TryGhost / Ghost

>= 4.9.0, < 6.54.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/TryGhost/Ghost/security/advisories/GHSA-pr22-p9rp-2cqv github.com: https://github.com/TryGhost/Ghost/pull/29635 github.com: https://github.com/TryGhost/Ghost/commit/a8bea3a4ceec4c852b880f4885119453c3d8588e github.com: https://github.com/TryGhost/Ghost/releases/tag/v6.54.1