Craft CMS versions 4.5.0‑RC1 through 4.16.18 and 5.0.0‑RC1 through 5.8.22 contain a stored cross‑site scripting vulnerability when an administrator uses the html column type in editable tables. The system does not sanitize input, allowing an attacker with an administrator account and with the allowAdminChanges setting enabled in production to inject arbitrary JavaScript. When another user views the page with the malicious table field the injected script runs in that user's browser, potentially leading to credential theft, session hijacking, and other client‑side compromises. The vulnerability is rated moderate with a CVSS score of 5.9 and is a typical stored XSS scenario.

Affected products are Craft CMS (craftcms:cms). The flaw applies to all releases from 4.5.0‑RC1 up to 4.16.18 and from 5.0.0‑RC1 up to 5.8.22. Versions 4.16.19 and 5.8.23 contain the patch that sanitizes the html column type field and resolves the issue.

The vulnerability requires the attacker to have an administrator account and to be able to modify content with allowAdminChanges enabled—conditions that are contrary to Craft’s security recommendations. The EPSS is less than 1%, indicating very low exploitation probability. The CVSS of 5.9 suggests a medium impact if exploited. Given the privileged setup needed, the overall risk is moderate, but patching or disabling admin changes is essential to mitigate any possibility of exploitation.