Craft has a Stored XSS in Entry Types Name

Craft CMS versions 5.0.0-RC1 through 5.8.21 are affected by a stored cross-site scripting (XSS) vulnerability in the Entry Type name field. The name is not sanitized when displayed in the Entry Types list within the control panel, allowing an attacker to inject arbitrary JavaScript that executes in the context of other users' browsers [1]. The root cause is the lack of output encoding; the fix in commit cfd6ba0 applies Html::encode() to the label before rendering [4].

To exploit this vulnerability, an attacker must have the ability to create or edit Entry Types—typically a user with administrative or content management privileges. When the malicious name is saved, any user who views the Entry Types list (including other administrators) will trigger the injected script. No additional authentication bypass is required, but the attacker must have a valid account with sufficient permissions [1][2].

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser within the Craft control panel session. This can lead to session hijacking, unauthorized actions performed on behalf of the victim, data exfiltration, or defacement of the admin interface. The impact is limited to the control panel context, but given the elevated privileges of typical viewers, the risk is significant [1].

The vulnerability is fixed in Craft CMS version 5.8.22, released on 2026-02-09 [2]. Users running any affected version (5.0.0-RC1 through 5.8.21) should upgrade immediately. No workarounds are documented; the only mitigation is applying the patch [4].