Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Craft CMS - CVE-2024-45406
Published: September 9, 2024 / Updated: April 17, 2026
Vulnerability identifier: #VU126472
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-45406
CWE-ID: CWE-80
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary script in the control panel.
The vulnerability exists due to improper neutralization of input during web page generation in breadcrumb list and title fields when rendering stored user-supplied category titles, entry titles, usernames, or full names. A remote user can store a specially crafted value in these fields to execute arbitrary script in the control panel.
User interaction is required to view an affected control panel page.
Affected software
Craft CMS
How to mitigate CVE-2024-45406
Install security update from vendor's website.
Craft CMS - update to 5.1.2