CVE-2026-34748

HIGH

8.7

Description

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser. This issue has been patched in version 3.78.0.

CVE Details

CVSS v3.1 Score8.7

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionREQUIRED

Published4/1/2026

Last Modified4/3/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-79

References

https://github.com/payloadcms/payload/security/advisories/GHSA-mmxc-95ch-2j7c(security-advisories@github.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.