Craft CMS vulnerable to cross site scripting in RSS feed widget
CVE-2023-31144
6.1MEDIUM
What is CVE-2023-31144?
Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.
Affected Version(s)
cms >= 3.0.0, < 3.8.4 < 3.0.0, 3.8.4
cms >= 4.0.0, < 4.4.4 < 4.0.0, 4.4.4