GHSA-wf98-vxv9-jqfv
XSS Injection Vulnerability
Impact
Under some circumstances, the Feeds widget on the dashboard could have an XSS vulnerability if a malformed feed was supplied.
Patches
This has been patched in Craft 3.7.29.
References
For more information
If you have any questions or comments about this advisory, email us at support@craftcms.com
Credits: https://github.com/noobpk
What each source reports
GitHub AdvisoriesNo score
XSS Injection Vulnerability
Impact
Under some circumstances, the Feeds widget on the dashboard could have an XSS vulnerability if a malformed feed was supplied.
Patches
This has been patched in Craft 3.7.29.
References
For more information
If you have any questions or comments about this advisory, email us at support@craftcms.com
Credits: https://github.com/noobpk
- Record
GHSA-wf98-vxv9-jqfv- Updated
- 2026-11-02
OSVNo score
XSS Injection Vulnerability
Impact
Under some circumstances, the Feeds widget on the dashboard could have an XSS vulnerability if a malformed feed was supplied.
Patches
This has been patched in Craft 3.7.29.
References
For more information
If you have any questions or comments about this advisory, email us at support@craftcms.com
Credits: https://github.com/noobpk
- Record
GHSA-wf98-vxv9-jqfv- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
craftcms/cmsPackagist | before 3.7.29 | 3.7.29 |
craftcms/cmsPackagist | before 3.7.29, plus listed versions 1.0.26.11.2.0-alpha.23101.2.0-alpha.23121.2.0-alpha.23161.2.0-alpha.2318 Show 45 moreShow less1.2.0-alpha.23191.2.0-alpha.23221.2.0-alpha.23231.2.0-alpha.23241.2.0-alpha.23281.2.0-alpha.23291.2.0-alpha.23321.2.23331.2.23351.2.23361.2.23371.2.23391.2.23581.2.23631.2.23671.2.23711.2.23751.2.23871.2.23921.2.23961.2.23991.3.0-alpha.23611.3.0-alpha.23661.3.0-alpha.23721.3.0-alpha.23741.3.0-alpha.23771.3.0-alpha.23781.3.0-alpha.23801.3.0-alpha.23881.3.0-alpha.23941.3.0-alpha.23971.3.0-alpha.24011.3.0-alpha.24021.3.0-alpha.24051.3.0-alpha.24641.3.24091.3.24101.3.24151.3.24161.3.24181.3.24191.3.24201.3.24221.3.24561.3.2459 | 3.7.29 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-wf98-vxv9-jqfv is a vulnerability with no CVSS score yet in craftcms/cms, published April 5, 2022. No source lists public exploit code. Fixed in craftcms/cms 3.7.29.
References
Left out here: 696 versions. The JSON record has them.