What is the CVSS score of CVE-2026-54720?

CVE-2026-54720 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2026-54720?

Yes, a public proof-of-concept exploit is available for CVE-2026-54720. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-54720?

Yes, a patch is available for CVE-2026-54720. Update the affected software to the latest version immediately.

Silverstripe Framework CVE-2026-54720

EUVD-2026-41144 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 GitHub_M

GHSA-gvrw-qqp5-jgc5

PHP XSS Silverstripe Silverstripe Framework

5.4

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

AV:N and PR:N because attacker only needs to host a malicious URL; UI:R reflects mandatory CMS editor interaction; no availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 01, 2026 - 22:02 EUVD

Analysis Generated

Jul 01, 2026 - 21:35 vuln.today

DescriptionCVE.org

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. In versions prior to 6.2.2, the "Insert media from web" functionality in the CMS is vulnerable to XSS from a specially crafted embed. This issue was fixed in version 6.2.2/

AnalysisAI

Cross-site scripting in Silverstripe Framework's 'Insert media from web' CMS feature allows a remote unauthenticated attacker to inject malicious JavaScript by supplying a specially crafted embed URL that a CMS editor then inserts into content. All Silverstripe Framework installations prior to version 6.2.2 are affected. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and network accessibility make it a credible risk for any deployment where CMS editors process externally sourced media.

Technical ContextAI

Silverstripe Framework is a PHP-based web application framework that powers the Silverstripe CMS. The affected component is the 'Insert media from web' embed functionality, which allows authenticated CMS editors to embed externally hosted media by providing a URL. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: the framework fails to properly sanitize or encode the embed content returned from an external source before rendering it in the browser, allowing injected HTML or JavaScript to execute. The affected CPE is cpe:2.3:a:silverstripe:silverstripe-framework:*:*:*:*:*:*:*:*, covering all versions of the framework prior to 6.2.2 in the 6.x line.

RemediationAI

Upgrade Silverstripe Framework to version 6.2.2, which contains the vendor-released patch for this issue. Details are available in the official security release at https://www.silverstripe.org/download/security-releases/cve-2026-54720 and the GitHub advisory at https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-gvrw-qqp5-jgc5. If an immediate upgrade is not possible, restrict CMS editor access so that only fully trusted users can use the 'Insert media from web' feature, reducing the attack surface by limiting who can insert externally sourced embeds. Disabling the embed/media-from-web feature entirely via CMS configuration is an effective compensating control with the trade-off of losing that editorial capability. Content Security Policy (CSP) headers can also limit the impact of any injected scripts by restricting script sources, though this does not eliminate the vulnerability.