CVE-2026-45011

ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross-site scripting vulnerability in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload. Because editors have permission to publish pages, the malicious widget can be published to the live site. When another user, including an administrator or public visitor, clicks the affected image/link, arbitrary JavaScript executes in the victim’s browser. As of time of publication, no known patched versions are available.

• CWE-79
• CWE-116

• https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe%404.29.0
• https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-5f64-7vfc-rcx6
• https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-5f64-7vfc-rcx6

Published

Jun 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45005OpenClaw before 2026.4.23 caches resolved webhook route secr…6
• CVE-2026-45006OpenClaw before 2026.4.23 contains an improper access contro…8.8
• CVE-2026-45007phpMyFAQ before 4.1.2 contains missing permission checks in …5.3
• CVE-2026-45008phpMyFAQ before 4.1.2 contains a path traversal vulnerabilit…7
• CVE-2026-45009phpMyFAQ before 4.1.2 contains an insufficient authorization…5.3
• CVE-2026-45010phpMyFAQ before 4.1.2 contains an improper restriction of ex…9.3
• CVE-2026-45012ApostropheCMS is an open-source Node.js content management s…7.6
• CVE-2026-45013ApostropheCMS is an open-source Node.js content management s…8.1
• CVE-2026-45014ApostropheCMS is an open-source Node.js content management s…5.3
• CVE-2026-45017Python Liquid is a Python engine for the Liquid template lan…7.5
• CVE-2026-4502IBM Langflow Desktop 1.2.0 through 1.8.4 Langflow could allo…6.5
• CVE-2026-45021Kuma is a modern Envoy-based service mesh that can run on ev…5.1