A stored Cross-site Scripting vulnerability in Statamic CMS allows authenticated users to execute malicious scripts in the context of higher-privileged administrator sessions.

This is a stored Cross-site Scripting (CWE-79) vulnerability occurring within the Collections and Taxonomies components. It requires an attacker to hold content creation permissions to inject malicious JavaScript that will subsequently execute when viewed by a user with higher privileges.

Successful exploitation of this vulnerability allows an attacker to compromise the sessions of administrative users. This may lead to unauthorized administrative actions, sensitive data exfiltration, or the full takeover of the content management system, resulting in significant reputational damage and operational disruption. Given the CVSS score of 8.0, this represents a high-severity risk that requires prompt attention.

Immediate Action: Update Statamic CMS to version 5.22.1 or later to implement the vendor-provided patch.

Proactive Monitoring: Review administrative access logs and monitor for anomalous script injections within Collections and Taxonomies content entries.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS filtering rules to detect and block malicious payloads submitted via content creation forms.

Public Exploit Available: Unknown.

The vulnerability presents a substantial risk to the integrity of the administrative environment. Organizations utilizing Statamic CMS must prioritize updating to version 5.22.1 immediately to eliminate the injection vector. Following the update, security teams should audit existing content entries to ensure no malicious scripts have been previously persisted by unauthorized or compromised accounts.