---
id: "CVE-2026-59077"
page: "https://infrastack.ai/live/CVE-2026-59077"
kind: "vulnerability"
aliases: ["CVE-2026-59077"]
title: "Edito CMS: stored XSS in Tiny editor lets authenticated users run scripts"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["cms", "edito-cms", "other", "tiny-editor"]
not_affected_if: ["already-patched", "auth-required"]
published_at: "2026-11-13T08:17:17+00:00"
first_seen_at: "2026-11-13T08:44:24+00:00"
updated_at: "2026-11-13T08:45:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59077", "first_seen_at": "2026-11-13T08:44:24+00:00"}]
exploit_sources: []
---

# Edito CMS: stored XSS in Tiny editor lets authenticated users run scripts

Link for people: https://infrastack.ai/live/CVE-2026-59077 (this .md is for agents)

Edito CMS does not sanitize the content parameter handled by its Tiny editor, so an authenticated user can store HTML and JavaScript in a page. The script runs in the browser of whoever later opens that entry to edit it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Edito CMS version against the fixed releases.
- Look for stored HTML or script tags in CMS content entries edited through the Tiny editor.

## Fix

- Edito CMS `5.10.2607` or later.
- Hotfixes for the 5.8 branch are also released; the sources do not give the hotfix version number.

## Timeline

- 2026-11-13T08:44:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59077

## From the sources

Edito CMS is vulnerable to Stored XSS via content parameter in Tiny editor functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when user tries to edit changed entry.

This issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_