@payloadcms/next has Stored XSS in Admin Panel

Description

A stored Cross-site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser.

Recommendation

Update the @payloadcms/next package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.78.0
• Patched version(s): 3.78.0

References

• GHSA-mmxc-95ch-2j7c
• CVE-2026-34748
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability - CVE-2026-30048
• Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order - CVE-2026-45665
• Trix has a Stored XSS vulnerability through serialized attributes - CVE-2026-73426
• PostCSS has XSS via Unescaped </style> in its CSS Stringify Output - CVE-2026-41305

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

@payloadcms/next