CVE-2023-31144

Name of the Vulnerable Software and Affected Versions Craft CMS versions 3.0.0 through 3.8.3 Craft CMS versions 3.8.4 is not affected for version 3, but versions prior to 4.4.4 are affected for version 4, so Craft CMS versions 4.0.0 through 4.4.3

Description A malformed title in the feed widget can deliver a cross-site scripting payload. This issue has been resolved in specific commits.

Recommendations For Craft CMS versions 3.0.0 through 3.8.3, update to version 3.8.4 to resolve the issue. For Craft CMS versions 4.0.0 through 4.4.3, update to version 4.4.4 to resolve the issue. As a temporary workaround, consider disabling the feed widget until a patch is available.