{"id":"CVE-2026-59077","kind":"vulnerability","aliases":["CVE-2026-59077"],"related":[],"title":"Edito CMS: stored XSS in Tiny editor lets authenticated users run scripts","description":"Edito CMS is vulnerable to Stored XSS via content parameter in Tiny editor functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when user tries to edit changed entry.\n\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.","summary":"Edito CMS does not sanitize the content parameter handled by its Tiny editor, so an authenticated user can store HTML and JavaScript in a page. The script runs in the browser of whoever later opens that entry to edit it.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","edito-cms","other","tiny-editor"],"not_affected_if":["already-patched","auth-required"],"how_to_check":"- Check the installed Edito CMS version against the fixed releases.\n- Look for stored HTML or script tags in CMS content entries edited through the Tiny editor.","fix":"- Edito CMS `5.10.2607` or later.\n- Hotfixes for the 5.8 branch are also released; the sources do not give the hotfix version number.","status":"open","published_at":"2026-11-13T08:17:17+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","triaged_at":"2026-11-13T08:45:28+00:00","updated_at":"2026-11-13T08:45:28+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T08:45:28Z","model":"claude-haiku-5-5","output":{"fix":"- Edito CMS `5.10.2607` or later.\n- Hotfixes for the 5.8 branch are also released; the sources do not give the hotfix version number.","reach":"network","title":"Edito CMS: stored XSS in Tiny editor lets authenticated users run scripts","impact":"medium","summary":"Edito CMS does not sanitize the content parameter handled by its Tiny editor, so an authenticated user can store HTML and JavaScript in a page. The script runs in the browser of whoever later opens that entry to edit it.","audience":"businesses","category":"other","nicknames":[],"who_cares":["edito-cms","cms","tiny-editor"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Scripts run in other editors' browsers, enabling session theft.","analyst_note":"unknown","how_to_check":"- Check the installed Edito CMS version against the fixed releases.\n- Look for stored HTML or script tags in CMS content entries edited through the Tiny editor.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["auth-required","already-patched"],"who_is_affected":"Sites running Edito CMS where users have accounts able to edit content through the Tiny editor. The sources do not say whether default installs expose the editor to unauthenticated users, so the attacker is assumed to need an account. Sites on versions before 5.10.2607 (and 5.8 without the hotfix) are the ones to look at.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4570,"output_tokens":550,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-59077':15A,18A '5.10.2607':107C '5.8':112C 'also':114C 'arbitrari':84C 'attack':81C 'authent':9A,42B,80C 'browser':57B 'chang':99C 'cms':2A,19B,22B,28B,67C 'content':33B,74C 'cve':13A,16A 'edit':65B,98C 'edito':1A,21B,27B,66C 'edito-cm':20B 'editor':7A,26B,39B,78C 'entri':63B,100C 'fix':104C 'function':79C 'handl':35B 'hotfix':108C 'html':46B,85C 'inject':83C 'issu':102C 'javascript':48B 'js':87C 'later':60B 'let':8A 'older':110C 'open':61B 'page':51B 'paramet':34B,75C 'releas':116C 'rendered/executed':93C 'run':11A,54B 'sanit':31B 'script':12A,53B 'store':3A,45B,71C 'tini':6A,25B,38B,77C 'tiny-editor':24B 'tri':96C 'user':10A,43B,95C 'version':106C,111C 'via':73C 'vulner':69C 'websit':89C 'whoever':59B 'xss':4A,72C","nicknames":[],"mitigations":[],"who_affected":"Sites running Edito CMS where users have accounts able to edit content through the Tiny editor. The sources do not say whether default installs expose the editor to unauthenticated users, so the attacker is assumed to need an account. Sites on versions before 5.10.2607 (and 5.8 without the hotfix) are the ones to look at.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cms","editocms","medium","other","tinyeditor"],"campaign_type":null,"search_a":"'-2026':14A,17A '-59077':15A,18A 'authent':9A 'cms':2A 'cve':13A,16A 'edito':1A 'editor':7A 'let':8A 'run':11A 'script':12A 'store':3A 'tini':6A 'user':10A 'xss':4A","search_b":"'authent':42B 'browser':57B 'cms':19B,22B,28B 'content':33B 'edit':65B 'edito':21B,27B 'edito-cm':20B 'editor':26B,39B 'entri':63B 'handl':35B 'html':46B 'javascript':48B 'later':60B 'open':61B 'page':51B 'paramet':34B 'run':54B 'sanit':31B 'script':53B 'store':45B 'tini':25B,38B 'tiny-editor':24B 'user':43B 'whoever':59B","search_c":"'5.10.2607':107C '5.8':112C 'also':114C 'arbitrari':84C 'attack':81C 'authent':80C 'chang':99C 'cms':67C 'content':74C 'edit':98C 'edito':66C 'editor':78C 'entri':100C 'fix':104C 'function':79C 'hotfix':108C 'html':85C 'inject':83C 'issu':102C 'js':87C 'older':110C 'paramet':75C 'releas':116C 'rendered/executed':93C 'store':71C 'tini':77C 'tri':96C 'user':95C 'version':106C,111C 'via':73C 'vulner':69C 'websit':89C 'xss':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T08:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59077","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59077","severity":null,"published_at":"2026-11-13T08:17:17+00:00","modified_at":"2026-11-13T08:17:17+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","fetched_at":"2026-11-13T08:44:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}