An authenticated user can bypass the restriction on the configured frontend URL in the DatoCMS Web Previews plugin, allowing the loading of arbitrary external resources or origins within iframes. This capability enables the presentation of content that may appear to originate from the trusted site. Based on the vulnerability’s functionality, it is inferred that an attacker could host malicious content that appears to come from the original site.

The affected product is the DatoCMS Web Previews plugin, any version preceding the 1.0.31 release. Users who have configured the plugin with a frontend URL are susceptible, and the vulnerability is specific to the DatoCMS environment.

The CVSS score is 4.8, and the EPSS score is less than 1 %. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires valid credentials; therefore the attack surface is limited to authenticated staff or contributors. While the probability of exploitation is low, once authenticated, an attacker can insert arbitrary iframe content that may undermine user trust.