What is CVE-2023-33194?

CVE-2023-33194 is a low-severity vulnerability in Craftcms Cms, classified under Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). CVSS score: 3.7/10. Published 2023-05-26.

How severe is CVE-2023-33194?

Low severity. CVSS v3 base score is 3.7 out of 10.

XSS in Craftcms Cms

CVE-2023-33194

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.

Published 2023-05-26 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L.

EPSS exploit prediction

EPSS: 0.006 (47.5th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 48th percentile — 47.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000

Affected products

Craftcms Cms — versions >= 4.0.0-RC1, < 4.4.6, >= 3.0.0, <= 3.8.5
Craftcms Craft Cms
Craftercms — versions 4.0.0

Weakness classification (CWE)

References

github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9 (Exploit)
github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888 (Patch)
github.com/craftcms/cms/releases/tag/4.4.6 (Release Notes)

Frequently asked questions

What is CVE-2023-33194?: CVE-2023-33194 is a low-severity vulnerability in Craftcms Cms, classified under Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). CVSS score: 3.7/10. Published 2023-05-26.
How severe is CVE-2023-33194?: Low severity. CVSS v3 base score is 3.7 out of 10.