The vulnerability arises from incomplete sanitization of return URLs in Craft CMS. The implemented strip_tags() call removes only angle‐bracketed HTML tags but does not filter URL schemes, allowing payloads such as javascript:alert(document.cookie) to survive. When the unsanitized return URL is later rendered in an href attribute, a reflected XSS attack can be triggered, leading to the execution of arbitrary JavaScript in the victim’s browser, which may compromise confidentiality of user data, hijack sessions, or perform other malicious actions. The weakness is identified as CWE-116 (Improper Encoding for Output) and CWE-79 (Improper Neutralization of Input).

The affected product is Craft CMS (craftcms:cms). All releases prior to the patch versions 5.9.7 and 4.17.3 contain the vulnerability. Updates to these or later versions contain the correct sanitization mechanism.

The CVSS score is 6.9, indicating a medium to high severity, while the EPSS score is below 1%, signifying a low probability of real‑world exploitation at the time of assessment. The alert is not listed in CISA’s KEV catalog. The attack vector is user‑controlled: an adversary can embed a malicious return URL in a link or redirect, and a victim who clicks the link will trigger the XSS payload. The requirement for user interaction and the fact that the attack occurs only when the return URL is rendered in an HTML attribute are key factors that modestly reduce overall risk but do not eliminate it.