Every CVE Search/ Get API key

CVE-2026-56383

Craft CMS - Stored XSS in Table Field via Row Heading Column Type

4.6 MediumFix available

Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administrator account (with allowAdminChanges enabled) to inject arbitrary JavaScript that executes when another user views a page containing the affected table field. Affected versions are >= 4.5.0-beta.1 through 4.16.18 and >= 5.0.0-RC1 through 5.8.22; fixed in 4.16.19 and 5.8.23.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
Active

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.22%Unchanged since Jun 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.6

Craft CMS - Stored XSS in Table Field via Row Heading Column Type

Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administrator account (with allowAdminChanges enabled) to inject arbitrary JavaScript that executes when another user views a page containing the affected table field. Affected versions are >= 4.5.0-beta.1 through 4.16.18 and >= 5.0.0-RC1 through 5.8.22; fixed in 4.16.19 and 5.8.23.

Record
CVE-2026-56383
CVSS 4.0
4.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2026-38177 4.6

Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administrator account (with allowAdminChanges enabled) to inject arbitrary JavaScript that executes when another user views a page containing the affected table field. Affected versions are >= 4.5.0-beta.1 through 4.16.18 and >= 5.0.0-RC1 through 5.8.22; fixed in 4.16.19 and 5.8.23.

Record
EUVD-2026-38177
CVSS 4.0
4.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Updated
2026-11-08
GitHub AdvisoriesGHSA-5w9j-w5p8-r4p7 4.6

Duplicate Advisory: Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-6j87-m5qx-9fqp. This link is maintained to preserve external references.

Original Description

Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administrator account (with allowAdminChanges enabled) to inject arbitrary JavaScript that executes when another user views a page containing the affected table field. Affected versions are >= 4.5.0-beta.1 through 4.16.18 and >= 5.0.0-RC1 through 5.8.22; fixed in 4.16.19 and 5.8.23.

Record
GHSA-5w9j-w5p8-r4p7
CVSS 4.0
4.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
GitHub AdvisoriesGHSA-6j87-m5qx-9fqp 2.3

Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type

A stored Cross-site Scripting (XSS) vulnerability exists in the editableTable.twig component when using the Row Heading column type. The application fails to sanitize input within row headings, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field.

Prerequisites

Steps to Reproduce

  1. Navigate to Settings → Fields and create a new field with Type: Table
  2. Add a Column Heading and set Column Type to Row Heading
  3. In Default Values section, add a row with the following payload: 
    <img src=x onerror="alert('XSS')">
  4. Enable Static Rows
  5. Use the field in any object (e.g., user profile fields) → then visit any user’s profile
  6. Notice the XSS execution

Resources

https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a

Record
GHSA-6j87-m5qx-9fqp
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-79
Updated
2026-11-02
NVD 4.6

Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administrator account (with allowAdminChanges enabled) to inject arbitrary JavaScript that executes when another user views a page containing the affected table field. Affected versions are >= 4.5.0-beta.1 through 4.16.18 and >= 5.0.0-RC1 through 5.8.22; fixed in 4.16.19 and 5.8.23.

Record
CVE-2026-56383
CVSS 4.0
4.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 4.6

Craft CMS - Stored XSS in Table Field via Row Heading Column Type

Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administrator account (with allowAdminChanges enabled) to inject arbitrary JavaScript that executes when another user views a page containing the affected table field. Affected versions are >= 4.5.0-beta.1 through 4.16.18 and >= 5.0.0-RC1 through 5.8.22; fixed in 4.16.19 and 5.8.23.

Record
CVE-2026-56383
CVSS 4.0
4.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-5w9j-w5p8-r4p7 4.6

Duplicate Advisory: Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-6j87-m5qx-9fqp. This link is maintained to preserve external references.

Original Description

Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administrator account (with allowAdminChanges enabled) to inject arbitrary JavaScript that executes when another user views a page containing the affected table field. Affected versions are >= 4.5.0-beta.1 through 4.16.18 and >= 5.0.0-RC1 through 5.8.22; fixed in 4.16.19 and 5.8.23.

Record
GHSA-5w9j-w5p8-r4p7
CVSS 4.0
4.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-6j87-m5qx-9fqp 2.3

Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type

A stored Cross-site Scripting (XSS) vulnerability exists in the editableTable.twig component when using the Row Heading column type. The application fails to sanitize input within row headings, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field.

Prerequisites

Steps to Reproduce

  1. Navigate to Settings → Fields and create a new field with Type: Table
  2. Add a Column Heading and set Column Type to Row Heading
  3. In Default Values section, add a row with the following payload: 
    <img src=x onerror="alert('XSS')">
  4. Enable Static Rows
  5. Use the field in any object (e.g., user profile fields) → then visit any user’s profile
  6. Notice the XSS execution

Resources

https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a

Record
GHSA-6j87-m5qx-9fqp
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVCLSA-2026-1784682948 No score

TuxCare security update for craftcms/cms (14 CVEs)

TuxCare rebuilt craftcms/cms to address 14 CVEs. Fixed in 3.9.15-p7+tuxcare.

Record
CLSA-2026-1784682948
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
craftcms/cms
Packagist
 4.5.0-beta.1 to 4.16.18
4.16.19
craftcms/cms
Packagist
 5.0.0-RC1 to 5.8.22
5.8.23
craftcms/cms
TuxCare:Packagist
From an advisory covering 12 CVEs
 3.9.15 up to 3.9.15-p7+tuxcare, plus listed versions
3.9.15-p1+tuxcare3.9.15-p2+tuxcare3.9.15-p3+tuxcare3.9.15-p4+tuxcare3.9.15-p5+tuxcare3.9.15-p6+tuxcare
3.9.15-p7+tuxcare
craftcms/cms
Packagist
 4.5.0-beta.1 up to 4.16.19, plus listed versions
4.10.04.10.0-beta.14.10.0-beta.24.10.14.10.2
Show 45 moreShow less
4.10.34.10.44.10.54.10.64.10.74.10.84.11.04.11.0.14.11.0.24.11.14.11.24.11.34.11.44.11.54.12.04.12.14.12.24.12.34.12.44.12.4.14.12.54.12.64.12.6.14.12.74.12.84.12.94.13.04.13.14.13.1.14.13.104.13.24.13.34.13.44.13.54.13.64.13.74.13.84.13.94.14.04.14.0.14.14.0.24.14.14.14.104.14.114.14.11.1
4.16.19
craftcms/cms
Packagist
 5.0.0-RC1 up to 5.8.23, plus listed versions
5.0.05.0.15.0.25.0.35.0.4
Show 45 moreShow less
5.0.55.0.65.1.05.1.15.1.105.1.25.1.35.1.45.1.55.1.65.1.75.1.85.1.95.2.05.2.0-beta.15.2.0-beta.25.2.0-beta.35.2.0-beta.45.2.0-beta.55.2.0-beta.65.2.15.2.105.2.25.2.35.2.45.2.4.15.2.55.2.65.2.75.2.85.2.95.3.05.3.0-beta.15.3.0-beta.25.3.0.15.3.0.25.3.0.35.3.15.3.25.3.35.3.45.3.55.3.65.4.05.4.0.1
5.8.23

History

History
RecordedChangedSources
affected, facts
affected
affected, aliases, products, referencesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-56383 is a medium vulnerability (CVSS 4.6) in Craftcms Cms, published February 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in craftcms/cms 4.16.19.

References

Show 5 moreShow less
This page doesn't list everything

Left out here: 189 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open