medium4.8
CVE-2026-84793
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input.
Impact
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages.
Affected products
| Product | Affected versions |
|---|---|
| Craft CMS Versions From 5.0.0-RC1 | before 5.10.11 |
Versions were read from the advisory text. No structured product data has been published for this record yet.