CVE-2023-33195

Name of the Vulnerable Software and Affected Versions Craft versions prior to 4.4.6

Description A malformed RSS feed can deliver an XSS payload. The issue can be triggered by the title in the <item> tag of an RSS feed. For example, creating an RSS widget and adding a malicious RSS feed can lead to the execution of the XSS payload.

Recommendations For versions prior to 4.4.6, update to version 4.4.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of RSS widgets or validating RSS feed sources to minimize the risk of exploitation.