CVE-2026-92590

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.7.0 through 5.10.12

Description A stored cross-site scripting issue exists in the Generated Fields feature. The flaw occurs because Twig autoescaping is disabled and cached values are not encoded. This allows content editors to inject malicious JavaScript through editable fields, which then executes within the authenticated Control Panel sessions of higher-privileged users when they view element indexes.

Recommendations Update Craft CMS to version 5.10.13 or later.