CVE-2023-31144: Craft CMS vulnerable to cross site scripting in RSS feed widget

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-09 · updated 2026-06-17
Weakness: CWE-79

Description

Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.

Affected products

craftcms cms: from 3.0.0 through 3.8.3; from 4.0.0 through 4.4.3

References

https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442
https://github.com/craftcms/cms/security/advisories/GHSA-j4mx-98hw-6rv6
https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442
https://github.com/craftcms/cms/security/advisories/GHSA-j4mx-98hw-6rv6

Get alerted when CVE-2023-31144 or the next vulnerability affects your stack