| Package | Affected versions | Patched versions |
|---|---|---|
| craftcms/cms | ≥ 4.0.0-RC1, < 4.4.12 | 4.4.12 |
| craft cms | ≤ 4.4.11 |
A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively. This issue was patched in version 4.4.12.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free