CVE-2023-31144: Craft CMS

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.

Affected products

• Craft CMS Craft CMS: from 3.0.0, up to and including 3.8.3; from 4.0.0, up to and including 4.4.3

Published 2023-05-09. Last modified 2026-06-17.