Craft CMS is a content‑management system that, in versions 5.0.0‑RC1 through 5.9.22, allows an author‑level control‑panel user to store a malicious JavaScript payload in an entry title. When an administrator or another control‑panel user with the saveEntries permission drags a different entry under the poisoned entry in the table view, the payload executes in the victim’s browser session. The flaw stems from the title being escaped only into a data‑title attribute, decoded again by the browser, read with jQuery .data('title'), and concatenated into new HTML without attribute escaping, providing a stored XSS vector.

All installations running Craft CMS versions 5.0.0‑RC1 through 5.9.22 are affected until the issue is addressed in newer versions.

The CVSS score of 5.9 indicates moderate severity, the EPSS score is less than 1% demonstrating a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an existing author‑level control‑panel account, the victim to perform a drag operation in the table view, and the victim’s session to be elevated at the time of trigger. Based on the description, it is inferred that the attack vector is the control‑panel UI, meaning both attacker and victim must interact with the drag‑and‑drop feature, thereby limiting practical risk to environments where such accounts and UI actions coexist.