{"id":"CVE-2023-31144","aliases":["GHSA-j4mx-98hw-6rv6"],"url":"https://o3.security/vulnerability/CVE-2023-31144","summary":"Craft CMS vulnerable to cross site scripting in RSS feed widget","details":"Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.","published":"2023-05-09T15:22:39.915Z","modified":"2026-08-08T03:47:40.051747142Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"3.8.4"},{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"4.4.4"}],"fix":{"url":"https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442","label":"craftcms/cms@52bd161"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31144.json"},{"type":"ADVISORY","url":"https://github.com/craftcms/cms/security/advisories/GHSA-j4mx-98hw-6rv6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31144"},{"type":"FIX","url":"https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-08T03:47:40.051747142Z"}}