CVE-2026-103266

Name of the Vulnerable Software and Affected Versions Ghost versions 5.2.0 through 6.61.0

Description An unauthenticated remote attacker can abuse the Stripe Checkout flow to attach a paid subscription to an existing member and modify that member's name. This process allows the injection of content into newsletters sent to the member. Depending on the email client used by the recipient, this injected content may lead to HTML injection or cross-site scripting (XSS), where malicious scripts are executed in the context of the user's browser.

Recommendations Update Ghost to version 6.62.0 or later.