Ghost contains a cross‑site scripting flaw in the feature_image_caption field that allows a staff user to embed malicious code in a post. When another staff member views the post, the injected script can hijack the Ghost Admin session, giving the attacker elevated privileges. The weakness is a classic input validation error (CWE‑79).

All TryGhost Ghost installations from version 4.9.0 up to and including 6.54.1 are affected. The problem was fixed in the 6.54.1 release.

The CVSS score of 4.3 indicates medium severity, and the vulnerability is not currently listed in the CISA KEV catalog. No EPSS data is available. The attack is most likely performed by a staff user who creates a post with a malicious feature_image_caption; the attacker then relies on a victim staff member visiting the post to trigger the hijack. Because the flaw relies on staff authentication, the risk is confined to accounts with post‑creating rights.