SHSelfHostIndex
AN

Anchor CMS

Lightweight blogging-focused CMS

Content Management Systems Archived ★ 3.3k stars Easy setup GPL-3.0

This project is archived. Upstream development has stopped, so expect no new features or security fixes. Consider an actively maintained content management systems alternative.

Anchor CMS is a super-simple, lightweight open-source blogging platform and CMS written in PHP. It focuses on minimalism and getting out of the writer's way.

Official siteSource code

Key features

  • Minimal and lightweight
  • Markdown editing
  • Simple theming
  • Quick setup

Pros & cons

Strengths

  • Very lightweight
  • Easy installation

Trade-offs

  • Limited features
  • Development inactive

Is Anchor CMS secure?

8 known vulnerabilities affect Anchor CMS's latest release (0.12.7) according to OSV.dev; the most severe is rated high.

Affecting 0.12.7

AdvisorySeveritySummary
CVE-2020-23342HighA CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users.
CVE-2024-37732HighCross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file.
CVE-2024-29499HighAnchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/users/delete/2.
CVE-2021-44116MediumCross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php.
CVE-2021-46253MediumA cross-site scripting (XSS) vulnerability in the Create Post function of Anchor CMS v0.12.7 allows attackers to execute arbitrary web scripts or HTML.
CVE-2025-46041MediumA stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript via the page description field in the page creation interface (/admin/pages/a...
CVE-2024-29338LowAnchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/categories/delete/2.
CVE-2022-25576UnknownAnchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php.
1 unconfirmed match

OSV.dev links these advisories to this release, but their own version data doesn't confirm it: they cover a separately versioned sub-package of the repository, or record the fix only as a commit. They are listed for completeness and not counted in the health score.

Matched by OSV, not confirmed

AdvisorySeveritySummary
CVE-2020-12071MediumAnchor 0.12.7 allows admins to cause XSS via crafted post content.
  • Most recent fixed advisory CVE-2026-88959, published 2026-09-10 (34 days ago), fixed in 0.12.7

Source: OSV.dev, checked 2026-10-14. How this is measured.

Anchor CMS replaces

Self-hosted WordPress alternatives

Health badge

Maintain Anchor CMS? Add its health score to your README. The badge links back to this page.

SelfHostIndex: 15 · archived

Markdown
[![SelfHostIndex health score for Anchor CMS](https://selfhostindex.com/badge/anchor-cms.svg)](https://selfhostindex.com/app/anchor-cms/)
HTML
<a href="https://selfhostindex.com/app/anchor-cms/"><img src="https://selfhostindex.com/badge/anchor-cms.svg" alt="SelfHostIndex health score for Anchor CMS"></a>
reStructuredText
.. image:: https://selfhostindex.com/badge/anchor-cms.svg
   :alt: SelfHostIndex health score for Anchor CMS
   :target: https://selfhostindex.com/app/anchor-cms/

The score is recomputed on every nightly rebuild from public repository data — see how it is calculated.

Compare Anchor CMS

21 head-to-head comparisons.

Similar content management systems apps