CVE-2026-25496
EUVD-2026-684509.02.2026, 20:15
Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a stored XSS vulnerability exists in the Number field type settings. The Prefix and Suffix fields are rendered using the |md|raw Twig filter without proper escaping, allowing script execution when the Number field is displayed on users' profiles. This issue is patched in versions 4.16.18 and 5.8.22.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| craftcms | craft_cms | 4.0.0 < 𝑥 < 4.16.18 |
| craftcms | craft_cms | 5.0.0 < 𝑥 < 5.8.22 |
| craftcms | craft_cms | 4.0.0 |
| craftcms | craft_cms | 4.0.0:rc1 |
| craftcms | craft_cms | 4.0.0:rc2 |
| craftcms | craft_cms | 4.0.0:rc3 |
| craftcms | craft_cms | 5.0.0 |
| craftcms | craft_cms | 5.0.0:rc1 |
𝑥
= Vulnerable software versions