Medium severity · published May 26, 2023
CVE-2023-33194
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an…
4.8
CVSS
0.6%
EPSS
No
On KEV
Description
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Craft Cms · Craftcms
3.0.0 before 3.8.6; 4.0.1 before 4.4.6 · source: NVD
CR
Craftercms · Craftercms
4.0.0; 4.0.0; 4.0.0; 4.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-33194
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-33194
Patch
https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888
Release Notes
https://github.com/craftcms/cms/releases/tag/4.4.6
Exploit
https://github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9
More from Craft Cms
10.0
CVE-2025-32432
Craft CMS Allows Remote Code Execution
9.8
CVE-2024-56145
RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms
8.1
CVE-2025-23209
Potential RCE with a compromised security key in craft/cms
5.3
CVE-2025-35939
Craft CMS stores user-provided content in session files
9.8
CVE-2026-32267
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()