CVE-2026-33051: Craft CMS Vulnerable to Stored XSS in Revision Context Menu
Craft CMS is a content management system (CMS). In versions 5.9.0-beta.1 through 5.9.10, the revision/draft context menu in the element editor renders the creator’s fullName as raw HTML due to the use of Template::raw() combined with Craft::t() string interpolation. A low-privileged control panel user (e.g., Author) can set their fullName to an XSS payload via the profile editor, then create an entry with two saves. If an administrator is logged in and executes a specifically crafted payload while an elevated session is active, the attacker’s account can be elevated to administrator. This issue has been fixed in version 5.9.11.
Other sources
The revision/draft context menu in the element editor renders the creator’s fullName as raw HTML due to the use of Template::raw() combined with Craft::t() string interpolation. A low-privileged control panel user (e.g., Author) can set their fullName to an XSS payload via the profile editor, then create an entry with two saves.
If an administrator is logged in and executes a specifically crafted payload while an elevated session is active, the attacker’s account can be elevated to administrator.
Users should update to Craft 5.9.11 with the patch to mitigate the issue.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33051?
CVE-2026-33051 has a low severity rating due to its limited impact on low-privileged control panel users.
How do I fix CVE-2026-33051?
To fix CVE-2026-33051, upgrade to Craft CMS version 5.9.11 or later.
Who is affected by CVE-2026-33051?
CVE-2026-33051 impacts low-privileged control panel users, such as Authors, who can exploit the vulnerability.
What is the nature of the vulnerability in CVE-2026-33051?
CVE-2026-33051 is an XSS vulnerability that arises from improperly rendering user input as raw HTML.
How does CVE-2026-33051 allow exploitation?
CVE-2026-33051 allows exploitation through the profile editor, where a user can set their fullName to an XSS payload.