Cross-site Scripting (XSS)

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Cross-site Scripting XSS via the selectedRevision path in the post history modal and feature image caption rendering code. An attacker can execute script in another staff user’s Admin session by creating o...

CVE-2026-70596: Improper Neutralization of Input During Web Page Generation

Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in featureimagecaption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is fixe...