CVE-2026-72787

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 5.10.8

Description A stored cross-site scripting issue exists in the control panel where draft names are rendered without HTML encoding in element chips and cards. This allows a low-privilege user with the ability to create element drafts to inject malicious JavaScript. The script executes in the browser of any higher-privileged user who views the affected element, potentially enabling unauthorized account creation and other authenticated actions.

Recommendations Update Craft CMS to version 5.10.8 or later.