CVE-2023-33195

MediumCVSS 5.0

Published: 27/05/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.65%

46th percentile - higher than 46% of all known CVEs

Summary

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6.

Risk Assessment

Exploitation of this vulnerability could lead to XSS attacks, threatening user data security and application integrity. Organizations may be at risk of data theft or other malicious actions.

Recommendation

It is recommended to upgrade to version 4.4.6 or later to mitigate this vulnerability. Additionally, RSS feeds should be monitored for malformed data.

Original NVD description (English source)

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6.