Is CVE-2026-84793 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-84793?

CVE-2026-84793 has a CVSS v3 severity of MEDIUM (4.8).

Back

CVE-2026-84793

Description

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages.