CVE-2023-23927: Craft CMS

Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days.

Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting (XSS) happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7.

Affected products

• Craft CMS Craft CMS: before 4.3.7 (fixed in 4.3.7)

Published 2023-03-03. Last modified 2026-06-17.