How severe is CVE-2026-49276?

CVE-2026-49276 has a CVSS 4.0 base score of 7.4, rated high severity.

Is CVE-2026-49276 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-49276?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-49276 published?

CVE-2026-49276 was published on 2026-07-09 and last updated on 2026-07-10.

CVE-2026-49276

CVE-2026-49276 is a high-severity vulnerability with a CVSS 4.0 base score of 7.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-83.

Key facts

Severity: High (CVSS 4.0 base score 7.4)
EPSS exploit prediction: 0% (22nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-83
Published: 2026-07-09
Last modified: 2026-07-10

Description

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any blueprint allowed a scripting link to be included as the target of a link or email link in writer mark components, making the target clickable by the user who entered it and enabling self cross-site scripting in the Panel. This issue is fixed in versions 4.9.4 and 5.4.4.

Frequently asked questions

What is CVE-2026-49276?: Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any blueprint allowed a scripting link to be included as the target of a link or email link in writer mark components, making the target clickable by the user who entered it and enabling self cross-site scripting in the Panel. This issue is fixed in versions 4.9.4 and 5.4.4.
How severe is CVE-2026-49276?: CVE-2026-49276 has a CVSS 4.0 base score of 7.4, rated high severity.
Is CVE-2026-49276 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-49276?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-49276 published?: CVE-2026-49276 was published on 2026-07-09 and last updated on 2026-07-10.

References

Other CWE-83 vulnerabilities

CVE-2026-45118 — Critical (CVSS 9.3): MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or…
CVE-2023-32070 — Critical (CVSS 9.0): XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous…
CVE-2024-26283 — High (CVSS 7.8): An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an…
CVE-2025-4615 — High (CVSS 7.2): An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS®…
CVE-2025-0125 — Medium (CVSS 6.9): An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS®…
CVE-2026-15920 — Medium (CVSS 6.1): An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before…

Browse all CWE-83 vulnerabilities →