Cross-site scripting in Craft CMS - CVE-2026-84793
Published: August 19, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU144275
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-84793
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in another user's browser.
The vulnerability exists due to cross-site scripting in the site name field when rendering the site name in the control panel without escaping. A remote user can store a malicious script in the site name to execute arbitrary JavaScript in another user's browser.
The issue affects the control panel and requires allowAdminChanges to be enabled.
Affected software
Craft CMS
How to mitigate CVE-2026-84793
Install security update from vendor's website.
Craft CMS - update to 5.10.11