What’s Vulnerable › Vulnerabilities

CVE-2026-103266: Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-01 · updated 2026-10-06
• Weakness: CWE-863

Description

Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the recipient's email client, the injected content may be rendered, resulting in HTML injection or cross-site scripting (XSS).

Affected products

• TryGhost Ghost: from 5.2.0 before 6.62.0 — fixed in 6.62.0

How to fix

Upgrade to a fixed version: TryGhost Ghost 6.62.0. Check the vendor advisory for mitigations.

References

• https://github.com/TryGhost/Ghost/security/advisories/GHSA-qppx-rw6v-xjqf
• https://www.vulncheck.com/advisories/ghost-5.2.0-before-6.62.0-unauthenticated-stripe-checkout-account-modification

Get alerted when CVE-2026-103266 or the next vulnerability affects your stack