CVE-2026-55793 is a stored cross-site scripting vulnerability in Craft CMS affecting versions 5.0.0-RC1 through 5.9.22. An attacker with at least author-level access can store a malicious JavaScript payload in an entry title. This payload executes in the context of a victim control panel user who has saveEntries permission for the same Structure section when they perform a drag operation under the poisoned entry in table view. The root cause is improper neutralization of input during web page generation: the title is escaped into a data-title attribute by the server, then decoded by the browser, read with jQuery .data('title'), and concatenated into a new HTML string without proper attribute escaping, enabling script execution. Exploitation requires the attacker to have an existing control panel account and the victim to perform a specific UI action with elevated session privileges. The vulnerability is fixed in Craft CMS version 5.9.23.

Successful exploitation allows an attacker with author-level access to execute arbitrary JavaScript in the context of a victim control panel user with higher privileges, potentially leading to session hijacking or unauthorized actions within the CMS. The attack requires user interaction (drag operation) and elevated victim privileges at trigger time. There are no known exploits in the wild.

This vulnerability is fixed in Craft CMS version 5.9.23. Users should upgrade to version 5.9.23 or later to remediate this issue. No other official remediation or temporary fixes are documented. Until patched, restrict author-level access and avoid performing drag operations in the control panel on entries from untrusted users.