CVE-2026-90561: Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG

Q: Which users can exploit this, and which users are targeted?

An authenticated user with the Author role can store malicious script tags in rich text fields. The script executes when an Editor or Super Admin expands the WYSIWYG preview pane.

Q: What interaction is required for exploitation?

The attacker must be able to submit content to a rich text field, and a higher-privileged user must expand the preview pane for that content. The issue is stored XSS, so the payload can persist until the preview is opened.

Q: What is the likely impact after successful exploitation?

Script execution occurs in the Editor or Super Admin's session and can enable account takeover. The vulnerability affects confidentiality and integrity, while no availability impact is indicated.

Q: How can I determine whether an instance is affected?

Instances running Strapi 4.x through 4.26.2 or Strapi 5.x before 5.48.1 are affected if Authors can use rich text fields and privileged users use the content manager WYSIWYG preview. Strapi 5.48.1 is not listed as affected.

Published Sep 13, 2026

Updated

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an Editor or Super Admin's session when the preview pane is expanded, enabling account takeover.

Affected Software

1 affected component

Strapi Strapi>=4.0.0<4.26.2, <4.26.2, >5.0.0<5.48.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Strapi content manager WYSIWYG preview to a version that resolves this vulnerability.
Fixed in 4.26.2
Upgrade
Upgrade Strapi content manager WYSIWYG preview to a version that resolves this vulnerability.
Fixed in 5.48.1

Event History

Sep 13, 2026

CVE Published

via MITRE·10:45 AM

Data Sourced

via MITRE·10:45 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this, and which users are targeted?

An authenticated user with the Author role can store malicious script tags in rich text fields. The script executes when an Editor or Super Admin expands the WYSIWYG preview pane.

What interaction is required for exploitation?

The attacker must be able to submit content to a rich text field, and a higher-privileged user must expand the preview pane for that content. The issue is stored XSS, so the payload can persist until the preview is opened.

What is the likely impact after successful exploitation?

Script execution occurs in the Editor or Super Admin's session and can enable account takeover. The vulnerability affects confidentiality and integrity, while no availability impact is indicated.

How can I determine whether an instance is affected?

Instances running Strapi 4.x through 4.26.2 or Strapi 5.x before 5.48.1 are affected if Authors can use rich text fields and privileged users use the content manager WYSIWYG preview. Strapi 5.48.1 is not listed as affected.

CVE-2026-90561: Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG

Affected Software

Remediation

Event History

Frequently Asked Questions

Which users can exploit this, and which users are targeted?

What interaction is required for exploitation?

What is the likely impact after successful exploitation?

How can I determine whether an instance is affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this, and which users are targeted?

What interaction is required for exploitation?

What is the likely impact after successful exploitation?

How can I determine whether an instance is affected?