CVE-2026-84793

EUVD-2026-69905
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.8 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/craftcms/cms/security/advisories/GHSA-5fjj-496j-2qqf
https://www.vulncheck.com/advisories/craft-cms-5.0.0-rc1-before-5.10.11-stored-xss-via-site-name
https://github.com/craftcms/cms/security/advisories/GHSA-5fjj-496j-2qqf