What is GHSA-wf9j-59pf-vfvj?

GHSA-wf9j-59pf-vfvj is a security advisory published by GitHub Security Advisories with Medium severity. Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting...

Which CVE IDs does GHSA-wf9j-59pf-vfvj cover?

GHSA-wf9j-59pf-vfvj covers the following CVE IDs: CVE-2026-84793. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wf9j-59pf-vfvj?

GHSA-wf9j-59pf-vfvj has a CVSS v3 base score of 4.8, published by GitHub Security Advisories.

GHSA-wf9j-59pf-vfvjMediumCVSS 4.8

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting...

Vendor

GitHub Security Advisories

Published

September 2, 2026

Last Modified

September 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-84793 →

📋 Description

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages.

🔗 References (4)

https://github.com/craftcms/cms/security/advisories/GHSA-5fjj-496j-2qqf
https://nvd.nist.gov/vuln/detail/CVE-2026-84793
https://www.vulncheck.com/advisories/craft-cms-5.0.0-rc1-before-5.10.11-stored-xss-via-site-name
https://github.com/advisories/GHSA-wf9j-59pf-vfvj