What’s Vulnerable › Vulnerabilities
CVE-2026-34748: @payloadcms/next has Stored XSS in Admin Panel
- Severity: high (CVSS 8.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-01 · updated 2026-10-26
- Weakness: CWE-79
Description
Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser. This issue has been patched in version 3.78.0.
Affected products
- payloadcms payload: before 3.78.0 — fixed in 3.78.0
How to fix
Upgrade to a fixed version: payloadcms payload 3.78.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-34748 or the next vulnerability affects your stack