CVE-2026-25491 — Craft has a Stored XSS in Entry Types Name
Craft is a platform for creating digital experiences. From 5.0.0-RC1 to 5.8.21, Craft has a stored XSS via Entry Type names. The name is not sanitized when displayed in the Entr…
Published: 2026-02-09 · CVSS: 1.9 · CVSS 4.0
Craft is a platform for creating digital experiences. From 5.0.0-RC1 to 5.8.21, Craft has a stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list. This vulnerability is fixed in 5.8.22.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7