CVE-2026-72787: Craft CMS CMS

Medium severity, CVSS 6.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browser of any higher-privileged user viewing the affected element, allowing account creation and other authenticated actions.

Affected products

• Craft CMS CMS: from 5.0.0-RC1, before 5.10.8 (fixed in 5.10.8)

Published 2026-08-12. Last modified 2026-10-08.