CVE-2023-33196: Craft CMS

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.

Affected products

• Craft CMS Craft CMS: from 4.0.1, before 4.4.7 (fixed in 4.4.7); version 4.0.0 only

Published 2023-05-26. Last modified 2026-06-17.