CVE-2026-49276CWE-83

Kirby: Self cross-site scripting (self-XSS) in the writer field

High · published July 9, 2026

CVSS v4.0
7.4
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any blueprint allowed a scripting link to be included as the target of a link or email link in writer mark components, making the target clickable by the user who entered it and enabling self cross-site scripting in the Panel. This issue is fixed in versions 4.9.4 and 5.4.4.

The record
Technical detail
CVSS v4.0
7.4 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00432 · 36.5th percentile
Weakness
CWE-83 · Improper Neutralization of Script in Attributes in a Web Page
Published
2026-07-09T18:48Z
EPSS history
Timeline
  • 09 JUL 18:48Z
    Kirby: Self cross-site scripting (self-XSS) in the writer field
    cvelistv5