CVE-2026-90561CWE-79cross-site-scripting

CVE-2026-90561

High · published September 13, 2026

CVSS v3.1
8.7
EPSS
0%
Percentile
36.2
In the wild
Unconfirmed
What it is

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an Editor or Super Admin's session when the preview pane is expanded, enabling account takeover.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
EPSS
0.00430 · 36.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-13T15:17Z
References (5)
https://github.com/strapi/strapi · [email protected]https://github.com/strapi/strapi/blob/v5.46.0/packages/core/content-manager/admin/src/pages/EditView/components/FormInputs/Wysiwyg/PreviewWysiwyg.tsx · [email protected]https://github.com/strapi/strapi/commit/875752612c30f951546904a29469e51e17e0ac37 · [email protected]https://github.com/strapi/strapi/issues/26857 · [email protected]https://www.vulncheck.com/advisories/strapi-4-x-through-4.26.2-and-5-x-before-5.48.1-stored-xss-via-wysiwyg · [email protected]
EPSS history
Timeline
  • 15 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 13 SEP 10:45Z
    Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG
    cvelistv5