CVE-2026-33051: Craft CMS Vulnerable to Stored XSS in Revision Context Menu

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-20 · updated 2026-06-17
Weakness: CWE-79

Description

Craft CMS is a content management system (CMS). In versions 5.9.0-beta.1 through 5.9.10, the revision/draft context menu in the element editor renders the creator’s fullName as raw HTML due to the use of Template::raw() combined with Craft::t() string interpolation. A low-privileged control panel user (e.g., Author) can set their fullName to an XSS payload via the profile editor, then create an entry with two saves. If an administrator is logged in and executes a specifically crafted payload while an elevated session is active, the attacker’s account can be elevated to administrator. This issue has been fixed in version 5.9.11.

Affected products

craftcms cms: from 5.9.0 before 5.9.11 — fixed in 5.9.11

How to fix

Upgrade to a fixed version: craftcms cms 5.9.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-33051 or the next vulnerability affects your stack