CVE-2026-84793: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in craftcms cms

CVE-2026-84793 is a stored cross-site scripting vulnerability affecting Craft CMS versions starting at 5.0.0-RC1 up to but not including 5.10.11. The vulnerability exists because the site name field does not properly neutralize input, allowing an attacker with administrator privileges to inject malicious JavaScript payloads. These payloads execute in the browsers of other users who access the control panel settings pages, potentially leading to session hijacking or other client-side attacks. The CVSS 4.0 base score is 4.8, indicating a medium severity issue with network attack vector, low complexity, and requiring administrator privileges and user interaction.

An attacker with administrator privileges can inject malicious scripts into the site name field, which will execute in the context of other users viewing the control panel settings. This can lead to unauthorized actions performed on behalf of those users or theft of sensitive information accessible via the control panel interface. The vulnerability does not allow privilege escalation or direct system compromise but poses a risk to user sessions and data confidentiality within the CMS control panel.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Until a patch is available, restrict administrator access to trusted users only and avoid viewing untrusted site name inputs in the control panel. Monitor vendor communications for updates on remediation.