CVE-2026-75526

Name of the Vulnerable Software and Affected Versions django CMS versions 5.0.8 through 5.0.8

Description In edit mode, the ContentRenderer.render placeholder function in cms/plugin rendering.py can pass stored, attacker-controlled values to the ContentRenderer.render exception function when plugin rendering fails. Values from get short description(), the exception message, the placeholder, or placeholder.source are interpolated into a cms-rendering-exception heading and returned via mark safe. Since the heading is not escaped, stored HTML can execute in the browser of an editor. This issue persists regardless of the settings.DEBUG configuration.

Recommendations Update to version 5.0.9.