ZeroDay Findings
Sign inSign up

Findings

CVE-2026-27126

Craft is a content management system (CMS).

Published Feb 24, 2026 · updated Jun 17, 2026 · craftcms craft cms

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-site Scripting (XSS) vulnerability exists in the component when using the column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. In order to exploit the vulnerability, an attacker must have an administrator account, and must be enabled in production, which is against Craft's security recommendations. Versions 4.16.19 and 5.8.23 patch the issue.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 24, 2026 · NIST NVD

    Detected

    Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-site Scripting (XSS) vulnerability exists in the component when using the column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. In order to exploit the v

  2. Jun 17, 2026 · NIST NVD

    Updated

    Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-site Scripting (XSS) vulnerability exists in the component when using the column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. In order to exploit the v

Affected

  • cpe craftcms/craft cmsversion unspecified
  • cpe craftcms/craft cms4.5.0
  • cpe craftcms/craft cms5.0.0

Sources

  • CVE.orgVulnerability recordCVE-2026-27126

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-27126

    Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-site Scripting (XSS) vulnerability exists in the component when using the column type. The application fails to sanitize the

    nvd.nist.gov

References