CVE-2023-36259: Craft CMS

Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days.

Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.

Affected products

• Craft CMS Craft CMS: before 3.0.2 (fixed in 3.0.2)

Published 2024-01-30. Last modified 2026-06-17.