CVE-2026-105643

Name of the Vulnerable Software and Affected Versions Ghost versions 6.34.0 through 6.66.0

Description Embed cards in the editor allow staff users, including those with Contributor roles, to bypass protections against stored cross-site scripting (XSS). This occurs when scripts are stored in post content and subsequently execute when another staff user opens the post in the editor, which could lead to the compromise of that user's admin session.

Recommendations Update to version 6.67.0. Maintain the security.embedPreviewUrl configuration option at its default value for self-hosted sites.