A high-severity Cross-site Scripting vulnerability in Ghost allows remote attackers to hijack user sessions through malicious links, posing a significant risk of unauthorized account access.

This is a Cross-site Scripting (CWE-79) vulnerability occurring in the Portal component. An attacker can craft a malicious link that, when clicked by an authenticated staff member or user, executes arbitrary JavaScript with the privileges of the victim.

The exploitation of this vulnerability can lead to full account takeover of administrative staff, resulting in unauthorized access to the content management system and sensitive data. With a CVSS score of 8.8, this flaw represents a major security risk that could lead to the compromise of site integrity, data exfiltration, or the distribution of malicious content to the site audience.

Immediate Action: Update your Ghost installation to version 5.121.0 or 6.15.0, which automatically includes the patched Portal component versions 2.51.5 or 2.57.1. For self-hosted or customized Portal implementations, you must manually rebuild or update to these specific patched versions.

Proactive Monitoring: Monitor server access logs and web application traffic for suspicious URL patterns or unexpected scripts being injected into user sessions.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to detect and block common XSS attack patterns in incoming requests to help mitigate risk until updates are applied.

Public Exploit Available: Unknown

This vulnerability presents a severe risk to the integrity of Ghost installations due to the potential for administrative account takeover. IT and security teams should prioritize the update to the latest patched versions of Ghost and the Portal component immediately. In environments where immediate patching is not feasible, restrict access to administrative interfaces and enforce strict content security policies to minimize the impact of potential XSS attacks.