904 matches found
CVE-2026-105649 Ghost: Stored XSS via SVG Uploads Bypassing Sanitization
Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in...
CVE-2026-105644
Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff...
CVE-2026-105643
The Ghost Node.js content management system (versions 6.34.0 through 6.67.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) via embed cards in the editor. This flaw allows any staff user, such as a Contributor , to embed malicious scripts in post content. When another staff user opens that p...
CVE-2026-105643 Ghost: Stored XSS via Embed Card Previews
Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the pos...
CVE-2026-105643
Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the pos...
CVE-2026-105643 Ghost: Stored XSS via Embed Card Previews
Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the pos...
CVE-2026-105643: Improper Neutralization of Input During Web Page Generation
Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the pos...
PT-2026-106184
Name of the Vulnerable Software and Affected Versions Ghost versions 2.1.0 through 6.63.0 Description Embedding a URL from an attacker-controlled website can lead to the storage of untrusted scripts within post content. These scripts may execute in the editor, on the published site, and in...
CVE-2026-105679: Improper Neutralization of Input During Web Page Generation
Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...
PT-2026-106177
Name of the Vulnerable Software and Affected Versions Ghost versions 6.34.0 through 6.66.0 Description Embed cards in the editor allow staff users, including those with Contributor roles, to bypass protections against stored cross-site scripting XSS. This occurs when scripts are stored in post...
CVE-2026-105650: Improper Neutralization of Input During Web Page Generation
Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulti...
CVE-2026-103292
Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...
CVE-2026-103292 Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head
Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...
CVE-2026-103277 Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed
Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially...
CVE-2026-103277 Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed
Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially...
CVE-2026-103277
Ghost versions from 2.5.0 before 6.34.0 are vulnerable to untrusted script execution within the oEmbed preview feature . The root cause is a failure to properly sandbox externally hosted scripts , allowing an attacker to craft malicious oEmbed content. This can lead to the execution of scripts in...
CVE-2026-85235
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible fo...
CVE-2026-85235 Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible fo...
CVE-2026-103277: Improper Neutralization of Input During Web Page Generation
Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially...
