CVE-2023-23927

Deeper analysis

Craft CMS is affected by a stored cross-site scripting vulnerability tracked as CVE-2023-23927. An attacker can supply a malicious payload in the label name or instruction field of an entry type; the payload is subsequently rendered without proper escaping inside the Quick Post widget on the administrative dashboard. The issue was present in versions prior to 4.3.7 and carries a CVSS 3.1 score of 6.1 with CWE-79.

Because the attack requires only network access and a victim to view the dashboard, an unauthenticated or low-privileged user who can create or edit entry types can cause script execution in the context of an administrative session. Successful exploitation yields the ability to read or modify limited dashboard content and potentially perform actions on behalf of the logged-in administrator.

The official Craft CMS changelog and the GitHub Security Advisory GHSA-qcrj-6ffc-v7hq state that the flaw is resolved in version 4.3.7; administrators are advised to upgrade promptly and to review any custom entry-type definitions that may contain untrusted label or instruction text.

EPSS for the CVE rose from a low baseline to a peak of 0.0955 on 2026-01-13 before receding to the current value of 0.0275, indicating a period of increased exploitation interest after public disclosure.