Skip to content

CVE-2024-23725

CVE-2024-23725

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries.

CVSS 6.1 · Medium · EPSS 0.4% · Fix available

Published: 2024-01-21T00:00:00.000Z
Updated: 2025-05-30T14:24:10.278Z

Stack: node

Affected products and versions

n/a
Versions
- n/a: Affected
No fix published
ghost npm
Affected ranges
- SEMVER: < 5.76.0
Update to 5.76.0

Original sources

Check your server →