Craft CMS is a content management platform that incorporates a revision or draft context menu in the element editor. A low‑privileged user with access to the control panel can set the fullName field in their profile to a malicious XSS payload. Because the system returns that name as raw HTML, the payload is stored in the database. When a privileged administrator subsequently opens a page that renders the menu, the stored script executes with administrative privileges, effectively elevating the attacker’s account.

Craft CMS versions 5.9.0‑beta.1 through 5.9.10 are vulnerable. The flaw was addressed in release 5.9.11, and later releases do not include this issue.

Based on the description, it is inferred that exploitation requires a low‑privileged user to first submit the malicious fullName, then an administrator to be actively logged in when the menu is rendered. The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1 % suggests a low probability of real‑world exploitation. This vulnerability is not listed in the CISA KEV catalog. The attack vector is a stored XSS that is executed within an elevated session during rendering of the context menu.