Craftcms Cms vulnerabilities

CVE-2026-72785 [MEDIUM] CWE-863 CVE-2026-72785: Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-pane Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without saveCategories) for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via the structures/move-element action. The structureEdit

CVE-2026-28782 [MEDIUM] CWE-639 CVE-2026-28782: Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, the "Duplicate" Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, the "Duplicate" entry action does not properly verify if the user has permission to perform this action on the specific target elements. Even with only "View Entries" permission (where the "Duplicate" action is restricted in the UI), a user can bypass this restricti

CVE-2017-8384 [MEDIUM] CWE-79 Craft CMS XSS Vulnerability Craft CMS XSS Vulnerability Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052.

CVE-2023-33196 [MEDIUM] CWE-80 CVE-2023-33196: Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.

CVE-2017-8383 [MEDIUM] CWE-284 Craft CMS Unauthorized View Craft CMS Unauthorized View Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the `craft/app/` folder.

CVE-2021-27902 [MEDIUM] CWE-79 Craft CMS Cross-site Scripting Vulnerability Craft CMS Cross-site Scripting Vulnerability An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.

CVE-2019-12823 [MEDIUM] CWE-79 Craft CMS XSS Vulnerability Craft CMS XSS Vulnerability Craft CMS before 3.1.31 does not properly filter XML feeds, thus allowing XSS.

CVE-2019-17496 [MEDIUM] CWE-79 Craft CMS XSS Vulnerability Craft CMS XSS Vulnerability Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion.

CVE-2026-25491 [MEDIUM] CWE-79 CVE-2026-25491: Craft is a platform for creating digital experiences. From 5.0.0-RC1 to 5.8.21, Craft has a stored X Craft is a platform for creating digital experiences. From 5.0.0-RC1 to 5.8.21, Craft has a stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list. This vulnerability is fixed in 5.8.22.

CVE-2026-56393 [MEDIUM] CWE-79 CVE-2026-56393: Craft CMS 4.x (>= 4.0.0-RC1, < 4.17.0-beta.1) and 5.x (>= 5.0.0-RC1, < 5.9.0-beta.1) contain multipl Craft CMS 4.x (>= 4.0.0-RC1, = 5.0.0-RC1, < 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where settings names and field option labels are rendered without sanitization (e.g., via the checkbox.twig template, which used {{ label|raw }}). An authenticated administrator (with allowAdminChanges enabled) can inject malicious p

CVE-2026-33161 [MEDIUM] CWE-200 CVE-2026-33161: Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can call assets/image-editor with the ID of a private asset they cannot view and still receive editor response data, including focalPoint. The endpoint returns private

CVE-2026-29113 [MEDIUM] CWE-352 CVE-2026-29113: Craft is a content management system (CMS). Prior to 4.17.3 and 5.9.7, Craft CMS has a CSRF issue in Craft is a content management system (CMS). Prior to 4.17.3 and 5.9.7, Craft CMS has a CSRF issue in the preview token endpoint at /actions/preview/create-token. The endpoint accepts an attacker-supplied previewToken. Because the action does not require POST and does not enforce a CSRF token, an attacker can force a logged-in victim editor to mint a

CVE-2022-37250 [MEDIUM] CWE-79 Craft CMS Stored Cross-site Scripting in User Addresses Title Craft CMS Stored Cross-site Scripting in User Addresses Title Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in `/admin/myaccount`.

CVE-2022-37247 [MEDIUM] CWE-79 Craft CMS vulnerable to stored Cross-site Scripting via /admin/settings/fields page Craft CMS vulnerable to stored Cross-site Scripting via /admin/settings/fields page Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page.

CVE-2022-37246 [MEDIUM] CWE-79 Craft CMS Cross-site Scripting vulnerability Craft CMS Cross-site Scripting vulnerability Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line `label: elementInfo.label`.

CVE-2023-30177 [MEDIUM] CWE-79 Cross Site Scripting in CraftCMS Cross Site Scripting in CraftCMS CraftCMS prior to version 3.7.68 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.

CVE-2026-109307 [MEDIUM] CWE-79 CVE-2026-109307: Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the contro Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a crafted /admin/login?verify=1 URL between password submiss

CVE-2020-19626 [MEDIUM] CWE-79 Craft CMS Cross-site Scripting Vulnerability Craft CMS Cross-site Scripting Vulnerability Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via `/admin/settings/sites/new`.

CVE-2022-37248 [MEDIUM] CWE-79 Craft CMS Cross site Scripting vulnerability Craft CMS Cross site Scripting vulnerability Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via `src/helpers/Cp.php`.

CVE-2022-37251 [MEDIUM] CWE-79 Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts Craft CMS `3.70-RC1`–`3.7.55.1` and `4.0.0-RC1`–`4.2.0.1` are vulnerable to Cross Site Scripting (XSS) via entry revisions and drafts. Versions `3.7.55.2` and `4.2.1` contain patches for this issue.