Craft CMS allows administrators to configure numeric fields with optional prefix and suffix text. These fields are rendered with the |md|raw Twig filter without escaping, permitting an attacker to submit script tags or other executable content. When the number field is displayed on a user profile, the injected script executes in the victim’s browser context, potentially allowing session hijacking, data theft, or malicious actions on behalf of the user. The vulnerability is a classic stored XSS (CWE‑79).

The flaw exists in Craft CMS versions 4.0.0‑RC1 through 4.16.17 and 5.0.0‑RC1 through 5.8.21. Users of any of these releases should verify their installed version and apply the update if necessary.

The CVSS score of 4.8 reflects moderate impact. The EPSS score of <1% indicates that current likelihood of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to edit the number field settings—a capability normally restricted to administrators. Once the malicious prefix or suffix is stored, any visitor to the affected profile page will execute the payload, making the attack effective against both authenticated and unauthenticated users. Due to the privileged nature of the write access required, the attack vector is best described as an authenticated internal or compromised‑account exploitation. The overall risk to a system that has not applied the patch is moderate but incremental over time as more vulnerable sites become discovered.