CVE-2023-33196: Craft CMS stored XSS in review volume

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-05-26 · updated 2026-06-17
Weakness: CWE-80

Description

Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.

Affected products

craftcms cms: from 4.0.1 before 4.4.7; 4.0.0, 4.0.0-rc1, 4.0.0-rc2, 4.0.0-rc3 — fixed in 4.4.7

How to fix

Upgrade to a fixed version: craftcms cms 4.4.7. Check the vendor advisory for mitigations.

References

https://github.com/craftcms/cms/commit/053d7119697e480ff81c5723bb9a33eaa49e0fc7
https://github.com/craftcms/cms/releases/tag/4.4.7
https://github.com/craftcms/cms/security/advisories/GHSA-cjmm-x9x9-m2w5
https://github.com/craftcms/cms/commit/053d7119697e480ff81c5723bb9a33eaa49e0fc7
https://github.com/craftcms/cms/releases/tag/4.4.7
https://github.com/craftcms/cms/security/advisories/GHSA-cjmm-x9x9-m2w5

Get alerted when CVE-2023-33196 or the next vulnerability affects your stack