CVE-2023-31144

MEDIUM

Craft CMS 3.0.0-3.8.3 and 4.0.0-4.4.3 - Stored Cross-Site Scripting via Feed Widget Title

Title source: llm

Description

Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.

References (2)

Core 2

Core References

Patch, Vendor Advisory x_refsource_confirm

https://github.com/craftcms/cms/security/advisories/GHSA-j4mx-98hw-6rv6

Patch x_refsource_misc

https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442

View Patch ZIP pw:eip

Scores

CVSS v3 6.1

EPSS 0.0041

EPSS Percentile 32.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (2)

craftcms/cms 3.0.0 - 3.8.4Packagist

craftcms/craft_cms 3.0.0 - 3.8.3

Published May 09, 2023

Tracked Since Feb 18, 2026