CVE-2018-20418

MEDIUM

Craft CMS 3.0.25 - Stored Cross-Site Scripting via Entry Title Field

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-20418. PoCs published by Raif Berkay Dincel.

AI-analyzed exploit summary This is a proof-of-concept for a stored XSS vulnerability in Craft CMS 3.0.25. The exploit demonstrates how an attacker can inject malicious JavaScript via the 'title' parameter in a POST request to the admin panel's entry save endpoint.

Description

index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.

Exploits (1)

exploitdb WORKING POC
by Raif Berkay Dincel · textwebappsphp
https://www.exploit-db.com/exploits/46054

This is a proof-of-concept for a stored XSS vulnerability in Craft CMS 3.0.25. The exploit demonstrates how an attacker can inject malicious JavaScript via the 'title' parameter in a POST request to the admin panel's entry save endpoint.

Classification
Working Poc 95%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Craft CMS 3.0.25
Auth required
Prerequisites: Valid admin session cookies · CSRF token · Access to the admin panel
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/rdincel1/Craft-CMS-3.0.25---Cross-Site-Scripting
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/46054/
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md

Scores

CVSS v3 4.8
EPSS 0.0047
EPSS Percentile 65.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
craftcms/cms 0Packagist
craftcms/craft_cms 3.0.25
Published Dec 24, 2018
Tracked Since Feb 18, 2026