CVE-2026-75526 debrief based on CVE Program and NVD records. The vulnerability affects django CMS versions from 5.0.8 until 5.0.9, allowing stored HTML execution in an editor's browser when plugin rendering fails in edit mode. Defenders should assess exposure and prioritize updating to version 5.0.9 or later. The fix uses format_html to escape the message before safe placeholder output is returned, preven [truncated]
CVE-2026-54624 is a medium-severity vulnerability in django CMS that allows staff accounts with CMS_PERMISSION to access restricted page structures, potentially exposing plugin descriptions. The issue is fixed in version 5.0.8. Defenders should review page view restrictions and CMS_PUBLIC_FOR settings, and upgrade to the fixed version. This vulnerability has a CVSS score of 6.5 and is considered medium-se [truncated]
A vulnerability in django CMS, a developer-friendly enterprise content management system, allows a staff user with the global add permission for a plugin type to copy plugins from an unauthorized page or placeholder into their clipboard and read secret text, link names, and URLs. This issue is fixed in version 5.0.8. The vulnerability arises from the copy_plugins endpoint in cms/admin/placeholderadmin.py, [truncated]
