SB2026073058 - Cross-site scripting in Ghost

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026073058

SB2026073058 - Cross-site scripting in Ghost

Published: July 30, 2026

Security Bulletin ID SB2026073058
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Cross-site scripting (CVE-ID: CVE-2026-53943)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script in victims' browsers and compromise staff user accounts.

The vulnerability exists due to improper neutralization of request-specific content in the frontend when processing requests with an x-ghost-preview header behind a shared caching layer. A remote attacker can send a specially crafted request with an x-ghost-preview header to execute arbitrary script in victims' browsers and compromise staff user accounts.

Exploitation requires a shared caching configuration that serves cached frontend responses across different visitors, and staff account exposure occurs only when the frontend and admin panel are hosted on the same domain.


Remediation

Install update from vendor's website.

References