The vulnerability is a stored cross‑site scripting flaw that occurs when the name of an Entry Type is not sanitized before being displayed in the Entry Types list. An attacker who can insert a malicious value into an Entry Type name can execute arbitrary JavaScript in the browsers of any user who later views that list, enabling client‑side code execution, session hijacking or defacement. The flaw is rated CVSS 1.9, indicating a low overall severity, but it still permits unauthenticated code execution in the context of a logged‑in user.

Craft CMS versions from 5.0.0‑RC1 up to and including 5.8.21 are affected. Administrators or users with the ability to create or edit Entry Types on any affected installation could exploit the flaw before it is patched. Versions 5.8.22 and later contain the fix.

Given the low CVSS score of 1.9 and an EPSS score of less than 1 percent, the likelihood of an active exploitation is small, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker possessing content authoring privileges who injects a malicious script into an Entry Type name; once the name is stored, the code runs for anyone who subsequently views the Entry Types list. Because the flaw requires edit access to the entry type, broader server‑side code execution cannot be achieved without also compromising higher privileges.