Stored Cross-Site Scripting in Craft CMS

A researcher at Tenable discovered a post-authentication stored cross-site scripting (XSS) vulnerability in Craft CMS core.

When creating a new field it is possible to inject html, including script tags, and inject an XSS payload which will be executed by users accessing the “Categories” and “Entries” pages.

Proof of Concept:

1. Create a new field with a name such as

2. Create a new category or section and add the field created in step …