CVE-2018-20418: Craft CMS

Medium severity, CVSS 4.8. EPSS: 3.7% chance of exploitation in the next 30 days.

index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.

Affected products

• Craft CMS Craft CMS: version 3.0.25 only

Published 2018-12-24. Last modified 2026-06-17.