TryGhost · weakness class
Cross-site Scripting
16 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- check available
- 1
Every one of the 16 is a mark on the map. Named now: 1 to 16, most at risk first.
- Ghost CMS <=4.32 - Cross-Site Scripting
- Ghost: Cross-Site Scripting in Universal Import
- @tryghost/activitypub: XSS in Ghost's ActivityPub client
- Ghost: Stored XSS via oEmbed Photo Responses
- Ghost: Stored XSS via SVG Files in Content Imports
- Ghost: Cross-Site Scripting in Feature Image Captions
- Ghost: Stored XSS via Bookmark Card Images
- Ghost: Stored XSS via SVG Uploads Bypassing Sanitization
- Ghost vulnerable to XSS via malicious Portal preview links
- Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses
- Ghost: Stored XSS via Embed Card Previews
- Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed
- Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images
- Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads
- Ghost: Stored XSS via File Uploads on Local Storage
- Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.