CVE-2026-59077: Stored XSS in Edito CMS

Q: Who can exploit this issue and when does the payload run?

An attacker needs an authenticated account and the ability to supply the content parameter in the Tiny editor functionality. The injected HTML or JavaScript executes when another user attempts to edit the modified entry.

Q: Which versions have a stated fix?

The issue was fixed in Edito CMS version 5.10.2607. Hotfixes are also available for older 5.8 versions.

Published Nov 13, 2026

Updated

Edito CMS is vulnerable to Stored XSS via content parameter in Tiny editor functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when user tries to edit changed entry.

This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.

Affected Software

1 affected component

Edito Edito CMS<5.10.2607

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Edito CMS to a version that resolves this vulnerability.
Fixed in 5.10.2607

Event History

Nov 13, 2026

CVE Published

via MITRE·07:27 AM

Data Sourced

via MITRE·07:27 AM

DescriptionWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue and when does the payload run?

An attacker needs an authenticated account and the ability to supply the content parameter in the Tiny editor functionality. The injected HTML or JavaScript executes when another user attempts to edit the modified entry.

Which versions have a stated fix?