CVE-2026-45014
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 are vulnerable to stored cross-site scripting via unsanitized user display name in draft version tooltip.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious scripts, potentially leading to user data theft or session hijacking. Organizations should be aware of the risks associated with using vulnerable versions.
Recommendation
It is recommended to upgrade to the latest version of ApostropheCMS as soon as a patch is released. In the meantime, consider restricting access to the system or implementing additional security measures.
Original NVD description (English source)
ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 are vulnerable to stored cross-site scripting via unsanitized user display name in draft version tooltip. As of time of publication, no known patched versions are available.