Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an Editor or Super Admin's session when the preview pane is expanded, enabling account takeover.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-13 | 1 | Patch1 |
| 2026-09-14 | 1 | Disclosure1 |
Strapi fixed the WYSIWYG preview XSS in June; the CVE arrived Sunday, and the end-of-life 4.x branch still ships the flaw. https://severitydaily.com/strapi-cve-2026-90561-wysiwyg-allowedtags-false-fixed-5-48-1-june-4-x-eol/
Post summary
The text discusses CVE-2026-90561, a WYSIWYG preview XSS vulnerability in Strapi, indicating that a fix was made in June but the end-of-life 4.x branch still contains the flaw.
High-severity stored XSS (CVSS 9.3) affects Strapi 4.x-4.26.2 and 5.x<5.48.1 in WYSIWYG preview. Update promptly if using this CMS: https://nvd.nist.gov/vuln/detail/CVE-2026-90561 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/BTGWV4V7K3
Post summary
The tweet discloses a high‑severity stored XSS (CVSS 9.3) affecting Strapi 4.x‑4.26.2 and 5.x<5.48.1 in WYSIWYG preview and urges users to update promptly.