Stored cross-site scripting (XSS) in Kirby CMS (CVE-2026-45368)

CVE-2026-45368 is a stored cross-site scripting (XSS) vulnerability in Kirby CMS affecting the `(link: …)` KirbyTag, the `link:` parameter of the `(image: …)` KirbyTag, the built-in image block with a link, and the HTML importer for blocks. An authenticated Panel user with update permission to any textarea or blocks field, or write access to content files through another vector, can inject malicious links using URI schemes such as `javascript://x%0A…`, `vbscript:`, `data:`, `livescript:`, `mocha:`, or `jar:` that bypass existing protections; when a site visitor clicks such a link in the frontend, arbitrary JavaScript executes in their browser, potentially granting the attacker full control of a victim's Panel session. Affected versions: - <=4.9.0 - 5.0.0-5.4.0 We recommend updating to: 4.9.1, 5.4.1. CVSS 8.4 · our assessment: this_week Vendor advisory: https://github.com/getkirby/kirby/security/advisories/GHSA-qvjf-922g-pj44 Details: https://vuln.today/cve/CVE-2026-45368