CVE-2026-84793: Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.11 - Configuration
Upgrade Craft CMS to 5.10.11 or later to fix stored XSS in the site name field; versions from 5.0.0-RC1 before 5.10.11 do not properly sanitize input.
Craft CMS site name field sanitization = Ensure input is properly sanitized before display (upgrade to a version where the stored XSS in the site name field is fixed)
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated administrator who can modify the site name field can store arbitrary JavaScript in that field. Exploitation also requires another user to view the relevant control panel settings pages.
Which deployments are affected?
Craft CMS versions from 5.0.0-RC1 up to, but not including, 5.10.11 are affected. The issue is in handling of the site name field in the control panel.
What is the practical impact?
A malicious administrator can cause JavaScript to execute in other users' browser sessions when they view control panel settings pages. The provided severity vector indicates low confidentiality and integrity impact, with no availability impact.