CVE-2026-45011 is a stored cross-site scripting vulnerability in ApostropheCMS version 4.29.0. The flaw exists in the image widget feature, where an Editor role user can insert a javascript: URL payload into an image widget link. Since Editors have publishing permissions, the malicious widget can be published live. This results in arbitrary JavaScript execution in the browsers of users who click the affected image or link. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-116. As of the publication date, no official fix or patch is available.

Successful exploitation allows an attacker with Editor privileges to inject malicious JavaScript that executes in the browsers of other users, including administrators and public visitors. This can lead to theft of sensitive information, session hijacking, or other client-side attacks. The vulnerability has a CVSS 3.1 score of 7.3 (High), indicating significant confidentiality and integrity impact without affecting availability.

No official patch or fix is currently available for this vulnerability. Until a patch is released, organizations should restrict Editor role permissions to trusted users only and consider disabling or limiting the use of image widget links that accept URLs. Monitor for suspicious activity related to published content. Check the vendor advisory regularly for updates on remediation.