Skip to content
Threat Feed

Tag

Cve-2026-45011

1 brief RSS
high advisory

ApostropheCMS Stored XSS via Image Widget Link (CVE-2026-45011)

A stored cross-site scripting vulnerability (CVE-2026-45011) was identified in ApostropheCMS image widget functionality, where a user with the Editor role can configure an image widget link to use a javascript: URL payload, which will execute arbitrary JavaScript in the victim’s browser when clicked.

apostrophecms xss cve-2026-45011 javascript
2r