Ghost CMS Portal XSS Vulnerability Leads to Remote Script Injection

EXECUTIVE SUMMARY:

A cross-site scripting (XSS) flaw has been observed CVE-2026-24778 in Ghost CMS and its Portal component that allows an attacker to craft a specially designed link which, when clicked by an authenticated staff or member user, executes arbitrary JavaScript with the victims permissions and could lead to account compromise or takeover. This vulnerability affects multiple released versions of Ghost as well as Portal versions, and attackers require minimal complexity and no privileges to exploit it, though user interaction is necessary; patches have been issued in later versions of both Ghost and Portal to remediate the issue, and operators should update to the fixed versions to prevent exploitation. The vulnerability has a CVSS score of 8.8.