Vulnerability Description
ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross-site scripting vulnerability in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload. Because editors have permission to publish pages, the malicious widget can be published to the live site. When another user, including an administrator or public visitor, clicks the affected image/link, arbitrary JavaScript executes in the victim’s browser. As of time of publication, no known patched versions are available.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe%404.29.0
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-5f64-7vfc-r
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-5f64-7vfc-r
FAQ
What is CVE-2026-45011?
CVE-2026-45011 is a vulnerability with a CVSS score of 7.3 (HIGH). ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross-site scripting vulnerability in the image widget functionality. A user with the Editor role can con...
How severe is CVE-2026-45011?
CVE-2026-45011 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-45011?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.