Ghost CMS: Stored XSS and privilege escalation (CVE-2025-66849)
A public exploit for CVE-2025-66849 has been published. The vulnerability is a stored XSS in the Ghost CMS HTML block that allows a Contributor to perform unauthorized actions by executing JavaScript in the context of an Owner account.
CVE search metadata
CVE search record: CVE-2025-66849. KEV: no. Product: Ghost CMS. Brief: Ghost CMS: Stored XSS and privilege escalation (CVE-2025-66849). Brief link: https://feed.craftedsignal.io/briefs/2026-10-ghost-cms-xss/
Triage facts
Revision 1- Applicability
- Ghost CMS
- Evidence
- Unknown
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 28, 20:23 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Likely
A public proof-of-concept (PoC) exploit has been published on Sploitus for CVE-2025-66849. According to the source, the vulnerability exists in the HTML block within the Ghost CMS post draft editor. An authenticated user with Contributor privileges can inject malicious JavaScript into a draft post. When an Owner account views or previews the post in the Ghost admin panel, the script executes with the Owner's privileges.