Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. Malicious user must have an account with control panel access and content creation permissions. This vulnerability can be exploited to allow super admin accounts to be created. This has been fixed in 6.2.3.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-11 | 2 | Disclosure2 |
| 2026-02-12 | 1 | Patch1 |
A privilege escalation flaw (CVE-2026-25759) affects Statamic CMS via stored #XSS. Apply the update to fix this vulnerability. #Statamic #CMS #Infosec https://www.pulsepatch.io/posts/cve-2026-25759-statamic-cms-privilege-escalation-xss
Post summary
The post announces a privilege‑escalation vulnerability in Statamic CMS caused by stored XSS and urges users to apply the available update for remediation.
CVE-2026-25759: Command Pwned: Stored XSS in Statamic's Command Palette A critical Stored Cross-Site Scripting (XSS) vulnerability in Statamic CMS allows authenticated content editors to inject malicious JavaScript into the global Command Palette. Whe... https://cvereports.com/reports/CVE-2026-25759
Post summary
The article announces a critical stored XSS vulnerability in Statamic CMS that allows authenticated editors to inject malicious JavaScript into the Command Palette. No PoC, exploit, active exploitation, or patch information is included.
CVE-2026-25759 Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authenticated … https://www.cve.org/CVERecord?id=CVE-2026-25759
Post summary
This note announces a stored XSS vulnerability (CVE-2026-25759) in Statmatic CMS for versions 6.0.0 to before 6.2.3, but contains no PoC, exploitation, patch, or false‑positive claims.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | statamic | statamic | - | - | - |