{"uuid": "848b5f6f-8023-4b61-a90b-6e6d32bde650", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90561", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117267511621881553", "content": "Strapi 4.x \u2013 4.26.2 & 5.x<5.48.1: CRITICAL stored XSS (CVE-2026-90561, CVSS 8.7) in WYSIWYG preview lets Author roles execute malicious scripts in higher-privileged sessions. Restrict roles & monitor vendor updates. https://radar.offseq.com/threat/strapi-versions-4x-through-4262-and-5x-before-5481-contain-a-stored-cross-site-scripting-vulnerability-e05bee9fce842336 #OffSeq #Strapi #XSS #Infosec", "creation_timestamp": "2026-09-14T04:30:29.361442Z"}