Stored cross-site scripting (XSS) in Kirby CMS (CVE-2026-44175)

CVE-2026-44175 is a stored cross-site scripting (XSS) vulnerability in Kirby CMS affecting the list field and list block components. Insufficient HTML sanitization on save allows an authenticated Panel user with update permission to inject malicious HTML via the API directly, which is then executed in the browsers of site visitors and logged-in users browsing the site frontend. Affected versions: - <=4.9.0 - 5.0.0-5.4.0 We recommend updating to: 4.9.1, 5.4.1. CVSS 8.5 · our assessment: this_week Vendor advisory: https://github.com/getkirby/kirby/security/advisories/GHSA-5fhx-9q32-q257 Details: https://vuln.today/cve/CVE-2026-44175