CVE-2026-84793: Craft CMS CMS

Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages.

Affected products

• Craft CMS CMS: from 5.0.0-RC1, before 5.10.11 (fixed in 5.10.11)

Published 2026-09-02. Last modified 2026-09-02.