This vulnerability occurs when an attacker who only needs a GitHub account can inject malicious JavaScript into the title of a GitHub issue in repos under the name craftcms/cms. When a site administrator uses the CraftSupport widget to search for feedback and the resulting list contains the poisoned issue title, the payload runs in the context of the admin’s control‑panel session. The flaw is a classic DOM‑based cross‑site scripting (CWE‑79) that allows the attacker to execute arbitrary JavaScript with the privileges of the site administrator.

All installations of Craft CMS version 4.0.0‑RC1 through 4.17.15 and version 5.0.0‑RC1 through 5.9.22 are vulnerable. The issue was fixed in 4.17.16 and 5.9.23, so any patch level equal to or newer than these removes the vulnerability.

The CVSS score of 7.4 marks it as high severity, but the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not in the CISA KEV catalog. An attacker only needs a GitHub account and an administrator who views the poisoned issue with the widget; no CMS credentials are required, so the attack vector is remote user‑interaction. The impact is confined to the admin session, but the attacker can perform any actions that the admin can, including stealing session cookies, modifying site content, or further phishing.