CVE-2024-26484

A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Link field. NOTE: the vendor's position is that this issue did not affect any version of Kirby CMS. The only effect was on the trykirby.com demo site, which is not customer-controlled.

• CWE-79

• https://github.com/getkirby/demokit/commit/d4877a6715cbf6517cb04ff57798851ffbd0cd7ePatch
• https://shrouded-trowel-50c.notion.site/Kirby-CMS-4-1-0-Stored-Cross-Site-Scripting-153b4eb557a2488188ad8167734ca226?pvs=4Exploit, Third Party Advisory
• https://github.com/getkirby/demokit/commit/d4877a6715cbf6517cb04ff57798851ffbd0cd7ePatch
• https://shrouded-trowel-50c.notion.site/Kirby-CMS-4-1-0-Stored-Cross-Site-Scripting-153b4eb557a2488188ad8167734ca226?pvs=4Exploit, Third Party Advisory

Published

Feb 22, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-26479An issue in Statping-ng v.0.91.0 allows an attacker to obtai…5.3
• CVE-2024-2648A vulnerability, which was classified as problematic, was fo…5.3
• CVE-2024-26480An issue in Statping-ng v.0.91.0 allows an attacker to obtai…7.5
• CVE-2024-26481Kirby CMS v4.1.0 was discovered to contain a reflected self-…4.7
• CVE-2024-26482An HTML injection vulnerability exists in the Edit Content L…7.1
• CVE-2024-26483An arbitrary file upload vulnerability in the Profile Image …8.8
• CVE-2024-26489A cross-site scripting (XSS) vulnerability in the Addon JD F…6.1
• CVE-2024-2649A vulnerability has been found in Netentsec NS-ASG Applicati…9.8
• CVE-2024-26490A cross-site scripting (XSS) vulnerability in the Addon JD S…5.4
• CVE-2024-26491A cross-site scripting (XSS) vulnerability in the Addon JD F…6.1
• CVE-2024-26492An issue in Online Diagnostic Lab Management System 1.0 allo…6.3
• CVE-2024-26495Cross Site Scripting (XSS) vulnerability in Friendica versio…6.1