CVE-2026-56393— Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-56393
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options
Source: NVD (National Vulnerability Database)
Vulnerability Description
Craft CMS 4.x (>= 4.0.0-RC1, < 4.17.0-beta.1) and 5.x (>= 5.0.0-RC1, < 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where settings names and field option labels are rendered without sanitization (e.g., via the checkbox.twig template, which used {{ label|raw }}). An authenticated administrator (with allowAdminChanges enabled) can inject malicious payloads into section names, volume names, user group names, global set names, generated field names, checkbox/radio option labels, and custom source labels, causing arbitrary JavaScript to execute in other users' control-panel sessions. Fixed in 4.17.0-beta.1 and 5.9.0-beta.1.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-56393
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-56393
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-56393 (1)
Other References for CVE-2026-56393 (3)
Same Patch Batch · craftcms · 2026-06-21 · 7 CVEs total
| CVE-2026-56382 | 7.2 HIGH | Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController |
| CVE-2026-56394 | 6.5 MEDIUM | Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter |
| CVE-2026-56383 | 4.8 MEDIUM | Craft CMS - Stored XSS in Table Field via Row Heading Column Type |
| CVE-2026-56381 | 4.8 MEDIUM | Craft CMS - Stored XSS via User Group Name in User Permissions Page |
| CVE-2026-56385 | 4.3 MEDIUM | Craft CMS - Authorization Bypass in assets/preview-file Endpoint |
| CVE-2026-56384 | 4.3 MEDIUM | Craft CMS - Missing Authorization in assets/preview-thumb Endpoint |
IV. Related Vulnerabilities
Same product: cms
- CVE-2026-56394
Craft CMS - Authenticated Path Traversal in assets/icon Exte - CVE-2026-56385
Craft CMS - Authorization Bypass in assets/preview-file Endp - CVE-2026-56384
Craft CMS - Missing Authorization in assets/preview-thumb En - CVE-2026-56383
Craft CMS - Stored XSS in Table Field via Row Heading Column - CVE-2026-56382
Craft CMS - Remote Code Execution via Missing Config Sanitiz
Same vendor: craftcms
- CVE-2026-56394
Craft CMS - Authenticated Path Traversal in assets/icon Exte - CVE-2026-56385
Craft CMS - Authorization Bypass in assets/preview-file Endp - CVE-2026-56384
Craft CMS - Missing Authorization in assets/preview-thumb En - CVE-2026-56383
Craft CMS - Stored XSS in Table Field via Row Heading Column - CVE-2026-56382
Craft CMS - Remote Code Execution via Missing Config Sanitiz
Same weakness: CWE-79
- CVE-2026-57656
WordPress Hester Core plugin <= 1.1.8 - Cross Site Scripting - CVE-2026-57651
WordPress Ghost Kit plugin <= 3.6.0 - Cross Site Scripting ( - CVE-2026-57650
WordPress Magazine Blocks plugin <= 1.8.3 - Cross Site Scrip - CVE-2026-57638
WordPress Fluent Booking plugin <= 2.1.0 - Cross Site Script - CVE-2026-57629
WordPress StatCounter plugin <= 2.1.1 - Cross Site Scripting
V. Comments for CVE-2026-56393
No comments yet