Description
Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | ghost | < 5.76.0 | 5.76.0 | GHSA-fh38-9fgr-454w |
Medium · 6.1
CVE-2024-23725
BIT-ghost-2024-23725EUVD-2024-0345GHSA-fh38-9fgr-454w
Cross-site Scripting in Ghost
Published Jan 21, 2024 · Updated May 30, 2025 · Assigned by mitre