---
id: CVE-2026-56383
title: Craft CMS - Stored XSS in Table Field via Row Heading Column Type
summary: >-
  Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the
  editableTable.twig component when using the 'Row Heading' column type. The
  application fails to sanitize input within row heading default values,
  allowing an att…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: craftcms
product: cms
affected:
  - cms >= 4.5.0-beta.1 < 4.16.19
  - cms >= 5.0.0-RC1 < 5.8.23
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-23T14:00:40.463813Z'
exploitAvailable: true
published: '2026-06-21'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:06:09.197Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56383'
references:
  - url: 'https://github.com/craftcms/cms/security/advisories/GHSA-6j87-m5qx-9fqp'
    label: GitHub Security Advisory (GHSA-6j87-m5qx-9fqp)
  - url: >-
      https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a
    label: >-
      https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a
  - url: >-
      https://www.vulncheck.com/advisories/craft-cms-stored-xss-in-table-field-via-row-heading-column-type
    label: >-
      VulnCheck Advisory: Craft CMS - Stored XSS in Table Field via Row Heading
      Column Type
tags:
  - cve.org
  - exploit-available
epss: 0.00218
epssPercentile: 0.12319
ingestedAt: '2026-11-08T14:51:22.351Z'
---

## Overview

Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administrator account (with allowAdminChanges enabled) to inject arbitrary JavaScript that executes when another user views a page containing the affected table field. Affected versions are >= 4.5.0-beta.1 through 4.16.18 and >= 5.0.0-RC1 through 5.8.22; fixed in 4.16.19 and 5.8.23.

## Affected

- `cms >= 4.5.0-beta.1 < 4.16.19`
- `cms >= 5.0.0-RC1 < 5.8.23`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.