Servers and applications

CVE-2023-31144

Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.

Severity: Medium 6.1
Published: 9 May 2023
Last changed: 17 Jun 2026
Added to UpHeron: 1 Nov 2026
Sources: NVD

Affected software

Software	Affected versions
Craft CMSServers and applications · `cpe:a:craftcms:craft_cms`	From 3.0.0 up to 3.8.3 From 4.0.0 up to 4.4.3

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2023-31144
CVE.org https://www.cve.org/CVERecord?id=CVE-2023-31144