CVE-2026-72787

Received Received - Intake

Stored XSS in Craft CMS Control Panel via Draft Names

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: VulnCheck

Description

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browser of any higher-privileged user viewing the affected element, allowing account creation and other authenticated actions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-72787

EUVD

EUVD-2026-57447

Affected Vendors & Products

Vendor	Product	Version / Range
craft_cms	craft_cms	to 5.10.8 (exc)
craftcms	craft_cms	From 5.0.0-RC1 (inc) to 5.10.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-72787 is a stored cross-site scripting (XSS) vulnerability in Craft CMS versions before 5.10.8. It occurs in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create drafts can inject malicious JavaScript that executes in the browser of higher-privileged users viewing the affected element.

Detection Guidance

Check Craft CMS version with: composer show craftcms/cms or check the control panel footer. Inspect draft names in element chips/cards for unusual JavaScript content. Review user activity logs for unauthorized actions like account creation.

Impact Analysis

An attacker with low privileges could inject JavaScript into draft names. When a higher-privileged user views the element, the script executes in their session. This could allow the attacker to perform actions like creating new user accounts or performing other authenticated actions on behalf of the victim.

Mitigation Strategies

Upgrade Craft CMS to version 5.10.8 or later immediately. Temporarily restrict draft creation permissions to trusted users until patching is complete. Monitor for suspicious activity in admin logs.

Hi! I’m here to help you understand CVE-2026-72787. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70