CVE-2020-9322 – Statamic Core XSS Vulnerability

CVE ID : CVE-2020-9322

Published : Aug. 8, 2025, 3:15 p.m. | 15 minutes ago

Description : The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user. This can be exploited via CSRF. Stored XSS can occur via a JavaScript payload in a username during account registration. Reflected XSS can occur via the /users PATH_INFO.

Severity: 8.8 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…