In Ghost CMS, the Universal Import feature allowed administrators to import content without proper sanitisation, permitting malicious actors to embed script tags that execute when the post is viewed. This flaw is an example of a classic input validation weakness, identified as CWE‑79. If an attacker can supply malicious content through the import flow, the injected scripts run in the victim’s browser, potentially exposing session data, defacing the page, or delivering additional malware.

The vulnerability exists in Ghost versions 5.26.0 through 6.54.0. The affected vendor is TryGhost and the product is Ghost CMS. The security fix was released in version 6.54.1; systems running earlier releases remain vulnerable.

The CVSS base score is 5.0, indicating a moderate risk level. EPSS information is not available and the issue is not listed in CISA KEV, implying it has not been widely exploited as of this analysis. Exploitation would require access to the admin import interface, which normally requires privileged credentials. Once an attacker can import content, the injected scripts can run when the post is displayed to site visitors, constituting a moderate threat. The vulnerability is mitigated by applying the 6.54.1 update.