Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2023-23927

Craft CMS stored cross-site scripting vulnerability

Description

Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting (XSS) happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

craftcms cms

  • < 4.3.7affected

References