← Database

CVE-2026-25491

MEDIUM CVSS: 4.8 Published: 2026-02-09 Modified: 2026-06-17

Description

Craft is a platform for creating digital experiences. From 5.0.0-RC1 to 5.8.21, Craft has a stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list. This vulnerability is fixed in 5.8.22.

Affected Platforms

Craftcms Craft Cms

Weakness Type

CWE-79

References