A vulnerability allows an authenticated user with write permissions in Payload’s admin panel to store malicious JavaScript content. When a different authenticated user later views the stored content, the script runs in that user’s browser, enabling arbitrary client‑side code execution. The weakness is a stored Cross‑Site Scripting flaw identified as CWE‑79.

The flaw affects the @payloadcms/next module of Payload CMS, a free, open‑source headless content management system. Any deployment running @payloadcms/next before version 3.78.0 is impacted, regardless of the underlying Node.js environment.

The CVSS score of 8.7 classifies the issue as high severity. The EPSS score of less than 1 % suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploit. An attacker would need valid credentials with write access to a collection; once malicious content is stored, any authenticated user who views the content experiences script execution. Consequently, the risk is primarily significant for systems where write permissions are broadly granted or where compromised accounts exist.