Ghost between versions 2.1.0 and 6.63.x can accept oEmbed photo URLs from attacker‑controlled sites, storing untrusted JavaScript in post content. The stored script runs inside the Ghost editor, on the published site, and in newsletters, creating a path to hijack a staff user’s admin session and potentially execute arbitrary code on the server. The vulnerability is classified as a prominent Stored XSS flaw with a CVSS score of 8.1, indicating a high severity impact on confidentiality, integrity, and availability for affected installations. This issue is fixed in version 6.64.0.

The flaw affects the Ghost content management system supplied by TryGhost. All installations running a Ghost release older than 6.64.0, specifically from version 2.1.0 up to 6.63.x, are vulnerable. Any site using the oEmbed photo response feature with external origins may store malicious payloads. No additional products or versions are listed as impacted.

With a high CVSS score of 8.1 and no EPSS data, the exploit probability remains uncertain but the risk is high by design. The vulnerability is not present in the CISA KEV catalog, indicating no known exploit activity at the time of publication. Based on how the flaw is triggered, the likely attack vector is a web‑browser interaction where the attacker supplies a crafted oEmbed URL; the gadget could be embedded either by a content author or via a malicious newsletter. Because the payload is stored and later rendered, an attacker could perform credential theft or session hijacking from the victim’s browser.