Skip to content
Threat Feed
Subscribe

Vendor

Ghost

4 briefs RSS
high threat

Unauthenticated Stripe Checkout Manipulation in Ghost

A vulnerability in Ghost versions 5.2.0 through 6.61.9 allows unauthenticated remote attackers to manipulate Stripe Checkout flows to modify member records and inject malicious content into newsletters.

exploited Ghost +7 web-vulnerability xss application-security enumeration api-security remote-code-execution vulnerability cms
9t 1c updated
medium threat

Arbitrary File Read in Ghost CMS via CVE-2023-40028

Ghost CMS versions prior to 5.59.1 are vulnerable to an authenticated arbitrary file read, exploitable through malicious symbolic link uploads via the administrative API.

exploited Ghost CMS ghost-cms arbitrary-file-read web-application cve-2023-40028 vulnerability
1r 1t 1c
high advisory

Cross-Site Scripting Vulnerability in Ghost ActivityPub Client

An XSS vulnerability in the @tryghost/activitypub package (CVE-2026-53950) allows attackers to inject arbitrary JavaScript via malicious ActivityPub server posts.

@tryghost/activitypub xss web-vulnerability activitypub
1t 1c
high advisory

Ghost CMS 6.19.0 SQL Injection Vulnerability

A SQL injection vulnerability exists in Ghost CMS 6.19.0, and a public exploit (EDB-52555) is available, increasing the risk to unpatched systems.

Ghost CMS 6.19.0 sqli webapps ghostcms
2r 1t