| Package | Affected versions | Patched versions |
|---|---|---|
| craftcms/cms | ≥ 3.7.24, < 3.7.64≥ 4.0.0-RC1, < 4.3.7 | 3.7.644.3.7 |
| craft cms | < 4.3.7 | 4.3.7 |
When you insert a payload inside a label name or instruction of an entry type, an XSS happens in the quick post widget on the admin dashboard.
Complete instructions, including specific configuration details, to reproduce the vulnerability.
Tested with the free version of Craft CMS 4.3.6.1
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free