CVE-2026-56383: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in craftcms cms
Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administrator account (with allowAdminChanges enabled) to inject arbitrary JavaScript that executes when another user views a page containing the affected table field. Affected versions are >= 4.5.0-beta.1 through 4.16.18 and >= 5.0.0-RC1 through 5.8.22; fixed in 4.16.19 and 5.8.23.
AI Analysis
Technical Summary
CVE-2026-56383 is a stored cross-site scripting vulnerability in Craft CMS affecting the editableTable.twig component's 'Row Heading' column type. The vulnerability arises because the application does not properly sanitize input in row heading default values, enabling an administrator with allowAdminChanges enabled to inject JavaScript code. This code executes in the context of other users viewing the affected table field, potentially leading to session hijacking or other script-based attacks. The vulnerability affects versions >=4.5.0-beta.1 through 4.16.18 and >=5.0.0-RC1 through 5.8.22 and is resolved in versions 4.16.19 and 5.8.23.
Potential Impact
An attacker with administrator privileges and allowAdminChanges enabled can inject arbitrary JavaScript code that executes in the browsers of other users viewing the affected table field. This can lead to typical XSS impacts such as session hijacking, unauthorized actions, or data theft. The vulnerability requires high privileges (administrator) and user interaction (viewing the affected page). The CVSS 4.0 score is 4.6 (medium severity), reflecting the need for elevated privileges and user interaction.
Mitigation Recommendations
Upgrade Craft CMS to version 4.16.19 or later if using the 4.x branch, or to version 5.8.23 or later if using the 5.x branch. These versions contain the fix for this stored XSS vulnerability. No other mitigations are indicated. Patch status is confirmed fixed in these versions.
CVE-2026-56383: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in craftcms cms
Description
Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administrator account (with allowAdminChanges enabled) to inject arbitrary JavaScript that executes when another user views a page containing the affected table field. Affected versions are >= 4.5.0-beta.1 through 4.16.18 and >= 5.0.0-RC1 through 5.8.22; fixed in 4.16.19 and 5.8.23.
CVSS v4.0
Score 4.6medium
Affected software
pkg:github/craftcms/cmsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-56383 is a stored cross-site scripting vulnerability in Craft CMS affecting the editableTable.twig component's 'Row Heading' column type. The vulnerability arises because the application does not properly sanitize input in row heading default values, enabling an administrator with allowAdminChanges enabled to inject JavaScript code. This code executes in the context of other users viewing the affected table field, potentially leading to session hijacking or other script-based attacks. The vulnerability affects versions >=4.5.0-beta.1 through 4.16.18 and >=5.0.0-RC1 through 5.8.22 and is resolved in versions 4.16.19 and 5.8.23.
Potential Impact
An attacker with administrator privileges and allowAdminChanges enabled can inject arbitrary JavaScript code that executes in the browsers of other users viewing the affected table field. This can lead to typical XSS impacts such as session hijacking, unauthorized actions, or data theft. The vulnerability requires high privileges (administrator) and user interaction (viewing the affected page). The CVSS 4.0 score is 4.6 (medium severity), reflecting the need for elevated privileges and user interaction.
Mitigation Recommendations
Upgrade Craft CMS to version 4.16.19 or later if using the 4.x branch, or to version 5.8.23 or later if using the 5.x branch. These versions contain the fix for this stored XSS vulnerability. No other mitigations are indicated. Patch status is confirmed fixed in these versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-21T02:05:47.495Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a37ed4baaf2dc2701b2275f
Added to database: 06/21/2026, 13:55:23 UTC
Last enriched: 06/28/2026, 21:46:39 UTC
Last updated: 08/05/2026, 00:41:15 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.