CVE-2026-28426 - Vulnerability Analysis

Overview

Statmatic < 5.73.11 and < 6.4.0 contains a stored XSS caused by improper sanitization in svg and icon components, letting authenticated users with permissions inject malicious JavaScript executed by higher-privileged users.

Severity & Score

Impact

Authenticated users can inject JavaScript that executes in higher-privileged users' browsers, potentially leading to session hijacking or privilege escalation.

Mitigation

Update to versions 5.73.11 or 6.4.0 or later.

References

• https://github.com/statamic/cms/releases/tag/v5.73.11
• https://github.com/statamic/cms/releases/tag/v6.4.0
• https://github.com/statamic/cms/security/advisories/GHSA-5vrj-wf7v-5wr7

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 28, 2026

🟠 CVE-2026-28426 - High (8.7) Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related components allow authenticated users with appropriate permissions to inject malicious Jav... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28426/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner