CVE-2023-33196

MediumCVSS 5.5

Published: 26/05/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.65%

46th percentile - higher than 46% of all known CVEs

Summary

Craft is a content management system (CMS) for creating custom digital experiences. A cross-site scripting (XSS) vulnerability can be triggered by review volumes. This issue has been fixed in version 4.4.7.

Risk Assessment

An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking. Organizations should update their systems to mitigate the risk.

Recommendation

It is recommended to update Craft to version 4.4.7 or later to eliminate this vulnerability. Regular monitoring and updating of software is crucial for maintaining security.

Original NVD description (English source)

Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.