https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-24T00:59:58.694084+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-267789 EUVD-2026-267789 2026-10-24T00:59:58.696263+00:00 EUVD-2026-267789 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25491 fkie_cve-2026-25491 2026-10-24T00:59:58.696297+00:00

Craft is a platform for creating digital experiences. From 5.0.0-RC1 to 5.8.21, Craft has a stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list. This vulnerability is fixed in 5.8.22.

 https://cve.radiocsirt.org/vuln/ghsa-7pr4-wx9w-mqwr GHSA-7pr4-wx9w-mqwr — Craft CMS Vulnerable to Stored XSS in Entry Types Name 2026-10-24T00:59:58.696328+00:00

Affected: Packagist: craftcms/cms

## Summary

Stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list.

--- ## Proof of Concept

### Required Permissions (Attacker)

- Admin access (only admins have access to the settings page) - `allowAdminChanges` is enabled in production, which is against our [security recommendations](https://craftcms.com/knowledge-base/securing-craft).

### Steps to Reproduce 1. Log in as an attacker. 2. Go to **Settings** -> **Entry Types** (`/admin/settings/entry-types`). 3. Create a new Entry Type. 4. Set **Name** to: ```html <img src=x onerror="alert('XSS-EntryTypes')" hidden> ``` 5. Save the Entry Type, and you’ll be redirected back to the entry types table automatically. 6. Notice the alert fires when the entry types table renders.