CVE-2026-56383: Craft CMS - Stored XSS in Table Field via Row Heading Column Type
Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administrator account (with allowAdminChanges enabled) to inject arbitrary JavaScript that executes when another user views a page containing the affected table field. Affected versions are >= 4.5.0-beta.1 through 4.16.18 and >= 5.0.0-RC1 through 5.8.22; fixed in 4.16.19 and 5.8.23.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 4.16.19 - Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.8.23
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56383?
CVE-2026-56383 has a medium severity score of 4.8.
How do I fix CVE-2026-56383?
To fix CVE-2026-56383, update to the latest secure version of Craft CMS that addresses this vulnerability.
What type of vulnerability is CVE-2026-56383?
CVE-2026-56383 is a stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-56383?
Users with administrator accounts in Craft CMS who utilize the Row Heading column type in editable tables are affected by CVE-2026-56383.
Can CVE-2026-56383 lead to unauthorized access?
Yes, CVE-2026-56383 can potentially allow attackers to execute malicious scripts if they gain access to an administrator account.