CVE-2026-78834

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

A code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin. An authenticated low-privileged user who can modify page content and provide controlled imported content can trigger server-side execution by referencing crafted external or uploaded text content through the affected content import feature.

Published 2026-09-08. Last modified 2026-09-09.