Craft CMS has a stored XSS vulnerability (CWE-79) in the editableTable.twig component's 'Row Heading' column type. The application does not properly sanitize input within row heading default values, enabling an attacker with administrator access and allowAdminChanges enabled to inject malicious JavaScript. This script executes in the context of other users viewing the affected table field. The vulnerability affects versions >=4.5.0-beta.1 through 4.16.18 and >=5.0.0-RC1 through 5.8.22 and is resolved in 4.16.19 and 5.8.23.

An attacker with administrator privileges and the allowAdminChanges setting enabled can inject arbitrary JavaScript code that executes in the browsers of other users viewing the affected table field. This can lead to information disclosure or other client-side impacts. The vulnerability requires high privileges and user interaction (viewing the page). There is no indication of active exploitation in the wild.

A fix is available in Craft CMS versions 4.16.19 and 5.8.23. Users should upgrade to these versions or later to remediate the vulnerability. No additional mitigation is indicated by the vendor advisory.