GHSA-7x94-jx75-3gh6
Stored cross site scripting in Craft CMS
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | craftcms/cms | >= 4.0.0-RC1, < 4.4.12 | 4.4.12 |
Details
As written in the advisory (Markdown source, shown as plain text).
A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively. This issue was patched in version 4.4.12.
References
External links from the advisory. They lead to third-party sites.