CVE-2026-59077 · Other
NO FIX YET · SEE WHAT TO DO
Edito CMS does not sanitize the content parameter handled by its Tiny editor, so an authenticated user can store HTML and JavaScript in a page. The script runs in the browser of whoever later opens that entry to edit it.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running Edito CMS where users have accounts able to edit content through the Tiny editor. The sources do not say whether default installs expose the editor to unauthenticated users, so the attacker is assumed to need an account. Sites on versions before 5.10.2607 (and 5.8 without the hotfix) are the ones to look at.
Not affected if already-patched, auth-required
Who cares cms, edito-cms, tiny-editor
5.10.2607 or later.Edito CMS is vulnerable to Stored XSS via content parameter in Tiny editor functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when user tries to edit changed entry.
This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.