CVE-2026-84793: Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-02 · updated 2026-09-02
Weakness: CWE-79

Description

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages.

Affected products

craftcms cms: from 5.0.0-RC1 before 5.10.11 — fixed in 5.10.11

How to fix

Upgrade to a fixed version: craftcms cms 5.10.11. Check the vendor advisory for mitigations.

References

https://github.com/craftcms/cms/security/advisories/GHSA-5fjj-496j-2qqf
https://www.vulncheck.com/advisories/craft-cms-5.0.0-rc1-before-5.10.11-stored-xss-via-site-name
https://github.com/craftcms/cms/security/advisories/GHSA-5fjj-496j-2qqf

Get alerted when CVE-2026-84793 or the next vulnerability affects your stack