CVE-2023-31144: Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a…

PriorityP423medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.41%

32.4th percentile

Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
craftcms	cms	—	—
craftcms	cms	—	—
craftcms	cms	>= 3.0.0 < 3.8.4	3.8.4
craftcms	cms	>= 4.0.0 < 4.4.4	4.4.4
craftcms	craft_cms	3.0.0 – 3.8.3	—
craftcms	craft_cms	4.0.0 – 4.4.3	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.