CVE-2026-92590: Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticated Control Panel sessions of higher-privileged users viewing element indexes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.13
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from the injected code?
A content editor who can modify editable fields can inject the malicious JavaScript. The code executes when a higher-privileged authenticated user views affected element indexes in the Control Panel.
Are all Craft CMS deployments affected?
The issue affects Craft CMS versions from 5.7.0 up to, but not including, 5.10.13, where the Generated Fields feature is in use. The described attack relies on editable fields and Control Panel users viewing element indexes.
What access and interaction are required for exploitation?
The attacker needs authenticated content-editor access and the ability to place payloads in editable fields. A higher-privileged authenticated user must subsequently view an affected element index for the stored script to execute.