CVE-2026-93456

5th percentile - higher than 5% of all known CVEs

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, enabling stored cross-site scripting attacks.

This vulnerability enables CSRF and stored XSS attacks, potentially leading to page content modification and execution of malicious scripts in visitors' browsers.

Update django-page-cms to a version later than 2.0.13 and enforce CSRF protection on all admin mutation views.