CyberRota Analysis
AI-GeneratedGhost versions prior to 6.64.0 are vulnerable to a stored cross-site scripting (XSS) flaw that enables attackers to inject malicious scripts through oEmbed photo responses. This vulnerability can compromise admin sessions and affect the integrity of published content and newsletters. Organizations using affected Ghost versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.