CVE-2026-49276

The record

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any blueprint allowed a scripting link to be included as the target of a link or email link in writer mark components, making the target clickable by the user who entered it and enabling self cross-site scripting in the Panel. This issue is fixed in versions 4.9.4 and 5.4.4.

Affected packages

Related vulnerabilities

• CVE-2026-45118 MyBB is free and open source forum software. CWE-83
• CVE-2026-15920 An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. CWE-83
• CVE-2026-62324 Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. CWE-83
• CVE-2026-48591 Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave… CWE-83
• GHSA-6xcg-6q43-rj2v Duplicate Advisory: Exported session HTML could keep unsafe markdown links CWE-83
• CVE-2026-53841 OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported… CWE-83
• GHSA-934w-87qh-qr26 Nuxt: Reflected XSS in `` via unsanitised `javascript:` or `data:` URL CWE-83
• CVE-2026-53722 Nuxt is an open-source web development framework for Vue.js. CWE-83