Ghost CMS CVE-2026-103266

Requires a Ghost instance (5.2.0 through <6.62.0) with Stripe-backed paid memberships enabled (the publicly reachable Stripe Checkout flow is the entry point) and the newsletter feature in use, since delivery of the injected content depends on a newsletter being sent to the targeted member. Exploitation is limited by: (1) victim interaction - a newsletter recipient must open the email (UI:P); and (2) the recipient's email client - script execution (XSS) only occurs in clients that render the injected markup, otherwise impact degrades to HTML injection/content spoofing. No attacker authentication is required (PR:N).

This is a genuine but conditional-impact issue rather than a drop-everything emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N, 7.1) correctly captures the key traits: fully remote, low complexity, no privileges required (PR:N) - consistent with the description's 'without authentication' - but it DOES require passive victim interaction (UI:P), namely a newsletter recipient opening the email. No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied intelligence, so by the precision rules this is 'no public exploit identified at time of analysis.' The real-world severity is further tempered by a dependency chain the CVSS score cannot express: the XSS only fires 'depending on the recipient's email client' - most modern webmail clients (Gmail, Outlook.com) strip or sandbox script, so the practical outcome for many targets degrades to HTML injection / content spoofing rather than script execution. The most reliable impact is therefore integrity abuse (attaching paid subscriptions to arbitrary existing members, altering member names, injecting newsletter content), which matches the high integrity weighting (VI:H). Note a labeling conflict to verify: the CWE is CWE-863 (Incorrect Authorization) and the Tags include 'Authentication Bypass,' yet the mechanism is abuse/misauthorization of an unauthenticated Stripe Checkout flow plus output injection - not a true authentication bypass. Treat this as a medium-priority patch for Ghost instances that have Stripe-backed paid memberships and newsletters enabled.

An unauthenticated attacker drives Ghost's public Stripe Checkout flow to attach a paid subscription to an existing member they do not own and overwrite that member's display name with an HTML/JavaScript payload. When Ghost later sends a newsletter that echoes the attacker-controlled member/content fields, a recipient opening the email in a permissive email client renders the injected markup, yielding HTML injection or XSS. No public proof-of-concept is identified in the supplied data; exploitation requires a victim to open the newsletter (UI:P).