Prior to versions 5.73.11 and 6.4.0, Statamic CMS allowed authenticated users with certain permissions to embed malicious JavaScript into SVG and icon components via a stored XSS flaw. When a higher‑privileged user later viewed the affected content, the injected script executed in the context of that privileged user, enabling the attacker to compromise data, hijack sessions, or gain administrative rights. The flaw is classified under CWE‑79 and carries a CVSS 8.7 score, indicating high potential impact.

The vulnerability affects the Statamic CMS product from vendor statamic:cms. All versions older than 5.73.11 for the 5.x series and older than 6.4.0 for the 6.x series are vulnerable.

The exploitation requires an authenticated user with permissions to modify SVG or icon components, making the attack vector web‑based and limited to users with edit rights. Although the EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild, the high CVSS score and the fact that the flaw enables privilege escalation raise the overall risk. The vulnerability is not listed in the CISA KEV catalog, but remediation remains critical to prevent potential compromise of privileged accounts.