CVE-2026-32612CWE-79

Statamic: privilege escalation via stored cross-site scripting

Medium · published March 12, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
16.8
In the wild
Unconfirmed
What it is

Statamic is a Laravel and Git powered content management system (CMS). Prior to 6.6.2, stored XSS in the control panel color mode preference allows authenticated users with control panel access to inject malicious JavaScript that executes when a higher-privileged user impersonates their account. This has been fixed in 6.6.2.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00260 · 16.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-12T21:47Z
EPSS history
Timeline
  • 12 MAR 21:47Z
    Statamic: privilege escalation via stored cross-site scripting
    cvelistv5