{"id":"CVE-2026-25491","aliases":["GHSA-7pr4-wx9w-mqwr"],"url":"https://o3.security/vulnerability/CVE-2026-25491","summary":"Craft has a Stored XSS in Entry Types Name","details":"Craft is a platform for creating digital experiences. From 5.0.0-RC1 to 5.8.21, Craft has a stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list. This vulnerability is fixed in 5.8.22.","published":"2026-02-09T19:25:29.690Z","modified":"2026-08-07T11:50:42.292043546Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"5.8.22"}],"fix":{"url":"https://github.com/craftcms/cms/commit/cfd6ba0e2ce1a59a02d75cae6558c4ace1ab8bd4","label":"craftcms/cms@cfd6ba0"},"references":[{"type":"WEB","url":"https://github.com/craftcms/cms/releases/tag/5.8.22"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25491.json"},{"type":"ADVISORY","url":"https://github.com/craftcms/cms/security/advisories/GHSA-7pr4-wx9w-mqwr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25491"},{"type":"FIX","url":"https://github.com/craftcms/cms/commit/cfd6ba0e2ce1a59a02d75cae6558c4ace1ab8bd4"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T11:50:42.292043546Z"}}