CVE-2026-55793: 
PHP vulnerability analysis and mitigation

CVE-2026-55793 is a stored cross-site scripting (XSS) vulnerability in Craft CMS titled "Stored XSS via Structure entry title in table view." It affects Craft CMS versions 5.0.0-RC1 through 5.9.22 and was discovered and privately reported by researcher Crypto-Cat, with the advisory published on June 16, 2026, and the CVE assigned on July 1, 2026. The vulnerability allows an Author-level control panel user to inject a malicious JavaScript payload into an entry title, which executes in the session of any higher-privileged user who performs a drag-and-drop operation in the Structure section table view. It carries a CVSS v4.0 base score of 5.9 (Medium) (GitHub Advisory, NVD).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically a DOM-based stored XSS in ElementTableSorter.js. The server correctly HTML-encodes the entry title into a data-title attribute, but the browser automatically decodes HTML entities when reading data attributes; jQuery's .data('title') then returns the decoded, attacker-controlled string. This value is passed to Craft.t() with a {title} token, which returns it verbatim (via case 'none': return arg in Craft.js), and the result is concatenated directly into a new HTML string passed to jQuery's $() constructor without calling Craft.escapeHtml(), causing the payload to be parsed as HTML and injected into the DOM. Exploitation requires the attacker to have createEntries + saveEntries permissions on a Structure-type section, and the victim must drag an entry to become the first child of the poisoned entry (triggering the 0-to-1 descendant transition). A proof-of-concept Python script (poc.py) was included in the advisory (GitHub Advisory, Fix Commit).

Successful exploitation allows an Author-level attacker to execute arbitrary JavaScript in the browser session of any control panel user with saveEntries permission on the same Structure section, including administrators. The payload can leverage Craft.csrfTokenName / Craft.csrfTokenValue to issue authenticated same-origin requests on behalf of the victim. In a demonstrated attack scenario, triggering the payload during an elevated admin session allowed full account takeover: the attacker changed the admin's email address via users/save-user, then used the password-reset flow to gain administrative access — escalating from Author to full admin privileges (GitHub Advisory).

A proof-of-concept Python script was included in the security advisory and is referenced by CISA's SSVC assessment (exploitation: "poc"), though no evidence of active in-the-wild exploitation has been observed (NVD, GitHub Advisory). The vulnerability is not automatable (requires victim interaction via drag-and-drop) and is not listed in the CISA KEV catalog. The EPSS score is approximately 0.41%, placing it in the 33rd percentile for exploitation likelihood within 30 days. No threat actor attribution has been reported (GitHub Advisory).

1. Obtain Author-level access: Acquire or compromise a Craft CMS control panel account with at minimum createEntries and saveEntries permissions on a Structure-type section.
2. Craft the malicious payload: Prepare a JavaScript payload (up to 255 characters, the title length limit) that performs the desired action — e.g., changing the victim admin's email via users/save-user using the victim's CSRF token. A tested 249-character payload was demonstrated in the advisory.
3. Plant the poisoned entry: Using the attacker's Author account, create an entry in the target Structure section and set its title to the crafted XSS payload. The PoC script automates this step: python3 poc.py --url http://target --cp admin --user author@example.com --pass secret --section mySection.
4. Ensure the poisoned entry has no children: The XSS fires only on the 0-to-1 descendant transition, so the poisoned entry must currently be childless.
5. Wait for victim interaction: The victim (e.g., an admin with an elevated session) must open the Structure section in Table view and drag another entry to become the first child of the poisoned entry.
6. Payload executes: When the drag completes, ElementTableSorter.js reads the poisoned data-title, constructs an HTML string without escaping, and the browser executes the injected JavaScript in the victim's session.
7. Account takeover (optional): If the victim has an elevated session, the payload can call users/save-user to change the admin's email to an attacker-controlled address, then trigger a password reset to fully take over the admin account (GitHub Advisory).

• Logs: Craft CMS access logs showing POST requests to /actions/users/save-user originating from an admin session at an unusual time or from an unexpected IP, particularly if the email field was changed.
• Logs: Password reset requests (/actions/users/send-password-reset-email) shortly after an admin session performed a drag-and-drop operation in a Structure section.
• Application Data: Entry titles in Structure sections containing HTML special characters such as <, >, ", or JavaScript keywords (script, onerror, onload, etc.).
• Network: Outbound requests from the Craft CMS control panel to unexpected external domains (e.g., attacker-controlled servers for data exfiltration) initiated during a drag-and-drop event.
• User Account Changes: Unexpected changes to admin user email addresses in the Craft CMS user management panel, especially if not initiated by the account owner (GitHub Advisory).

The vulnerability is fixed in Craft CMS version 5.9.23 (and later), where the fix applies Craft.escapeHtml() to the ancestorTitle value before it is used in jQuery attribute construction, preventing HTML injection (Fix Commit). All users running versions 5.0.0-RC1 through 5.9.22 should upgrade immediately. As interim mitigations, restrict control panel access to trusted users only, limit Author-role permissions to the minimum necessary, and consider implementing a strict Content Security Policy (CSP) to reduce XSS impact. Only Structure-type sections are affected; Channel and Single sections are not vulnerable (GitHub Advisory).

The vulnerability was reported by researcher Crypto-Cat and credited in the official GitHub Security Advisory. The Intigriti Bug Bytes newsletter (issue #237, June 2026) highlighted this CVE as a notable finding, indicating some community attention within the bug bounty and security research space (Intigriti Bug Bytes). No major vendor statements beyond the official advisory or significant social media controversy have been identified.