diff --git a/docs/NEWS b/docs/NEWS
index 027e8871..22d3300f 100644
--- a/docs/NEWS
+++ b/docs/NEWS
@@ -71,6 +71,8 @@ Version 1.6 ()
 Version 1.5.4 (August 26th, 2010)
 ------------------------------------------------------------------------
 
+    * Fix XSS in backend, thanks to High-Tech Bridge SA #HTB22595
+
     * Fix PHP 5.3.2 parse error in a file, thanks to fyremoon
 
     * Fix SQL query statement for deleting a category, which on some
diff --git a/include/functions_config.inc.php b/include/functions_config.inc.php
index 64094b42..52f1caab 100644
--- a/include/functions_config.inc.php
+++ b/include/functions_config.inc.php
@@ -846,6 +846,10 @@ function serendipity_iframe_create($mode, &$entry) {
         return true;
     }
 
+    if (!serendipity_checkFormToken()) {
+        return false;
+    }
+
     $_SESSION['save_entry']      = $entry;
     $_SESSION['save_entry_POST'] = $serendipity['POST'];