CVE-2024-23725

score

<0.1

cvss

6.1

epss

0.4%

published

2024-01-21

kev added

—

first seen

2026-10-21

Ghost before 5.76.0 contains a reflected cross-site scripting caused by unsanitized post excerpt in excerpt.js, letting attackers execute malicious scripts in post summaries, exploit requires attacker to craft and deliver malicious payload.