Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `html` column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. In order to exploit the vulnerability, an attacker must have an administrator account, and `allowAdminChanges` must be enabled in production, which is against Craft's security recommendations. Versions 4.16.19 and 5.8.23 patch the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 1 product
CVE-2026-27126 Stored XSS Vulnerability in Craft CMS via Unsanitized HTML Column Type https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27126
Post summary
The text announces a stored XSS vulnerability in Craft CMS caused by an unsanitized HTML column type, linking to a vulnerability detail page for more information.
CVE-2026-27126 Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-site Scripting (XSS) vulnerability exis… https://www.cve.org/CVERecord?id=CVE-2026-27126
Post summary
The text announces a stored XSS vulnerability in Craft CMS versions 4.5.0‑RC1 to 4.16.18 and 5.0.0‑RC1 to 5.8.22, with no mention of PoC, exploit, or patch.
CVE-2026-27126: Table for Two: Serving Stored XSS in Craft CMS Hidden Features A hidden, semi-internal 'html' column type in Craft CMS's Table Field component allowed authenticated administrators to inject arbitrary JavaScript. By manipulating field c... https://cvereports.com/reports/CVE-2026-27126
Post summary
The post discloses a stored XSS vulnerability in Craft CMS’s Table Field component that permits authenticated administrators to inject arbitrary JavaScript via a hidden 'html' column type.
5 of 5 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | craftcms | craft_cms | - | - | - |
| App | craftcms | craft_cms | 4.5.0 | - | - |
| App | craftcms | craft_cms | 4.5.0 | - | - |
| App | craftcms | craft_cms | 5.0.0 | - | - |
| App | craftcms | craft_cms | 5.0.0 | - | - |