Vulnerability record/PUBLISHED/Published Nov 13, 2026 07:27:42 UTC

CVE-2026-59077

Edito CMS is vulnerable to Stored XSS via content parameter in Tiny editor functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when user tries to edit changed entry. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.

Base score5.1/ 10

SeverityMediumCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorNetworkAV

Attack complexityLowAC

Attack requirementsNoneAT

Privileges requiredLowPR

User interactionPassiveUI

Vulnerable system confidentialityNoneVC

Vulnerable system integrityNoneVI

Vulnerable system availabilityNoneVA

Subsequent system confidentialityLowSC

Subsequent system integrityLowSI

Subsequent system availabilityNoneSA

CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityCERT-PL

Last updatedNov 13, 2026 07:27:42 UTC

PublishedNov 13, 2026 07:27:42 UTC

ReservedJul 2, 2026 08:57:58 UTC

Credits

Michał Majchrowicz (AFINE Team)
Dawid Małecki (AFINE Team)
Paweł Zdunek (AFINE Team)