CVE-2026-45011
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
ApostropheCMS version 4.29.0 has a stored XSS vulnerability in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload, allowing a malicious widget to be published on the site.
Risk Assessment
The malicious widget can be published on the site, exposing users, including administrators, to arbitrary JavaScript execution in their browsers. This poses a serious threat to data security and system integrity.
Recommendation
It is recommended to avoid using version 4.29.0 and to monitor for available updates that may patch this vulnerability. Additionally, it is advisable to restrict editor permissions for publishing to minimize risk.
Original NVD description (English source)
ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross-site scripting vulnerability in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload. Because editors have permission to publish pages, the malicious widget can be published to the live site. When another user, including an administrator or public visitor, clicks the affected image/link, arbitrary JavaScript executes in the victim’s browser. As of time of publication, no known patched versions are available.