CVE-2026-92590
Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticated Control Panel sessions of higher-privileged users viewing element indexes.
| CWE | CWE-79 |
| Vendor | craftcms |
| Product | cms |
| Published | Sep 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for craftcms cms
Be the first to know when new medium vulnerabilities affecting craftcms cms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
craftcms / cms
5.7.0 < 5.10.13
References
Credits
🔍 unclecui233