Brand
Craft CMS: actively exploited vulnerabilities
4 vulnerabilities in Craft CMS products (Craft CMS) are in CISA’s catalog of exploited vulnerabilities. Last added: March 20, 2026.
The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).
-
1 vulnerability added in the last 12 months
-
4 exploited vulnerabilities in the catalog, in total
-
0 added in the last 30 days
By category
Add just one Craft CMS category to your radar, or open its page.
- CMS, e-commerce and websites 4 vulnerabilities
A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.
Affected products
- Craft CMS 4 vulnerabilities · CMS and websites
Name used by CISA: Craft CMS. Product families: indicative classification by this site.
Patch first
In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Craft CMS list.
Rank 1Craft CMS
CVE-2025-32432Craft CMS Code Injection Vulnerability
Added in the last 12 months: ranked by severity.
- Added
- Mar 20, 2026
- CISA deadline
- 14 days
- CVSS severity
- 10.0 (critical)
Rank 2Craft CMS
CVE-2024-56145Craft CMS Code Injection Vulnerability
Added more than a year ago: ranked by severity.
- Added
- Jun 2, 2025
- CISA deadline
- 21 days
- CVSS severity
- 9.8 (critical)
Rank 3Craft CMS
CVE-2025-23209Craft CMS Code Injection Vulnerability
Added more than a year ago: ranked by severity.
- Added
- Feb 20, 2025
- CISA deadline
- 21 days
- CVSS severity
- 8.1 (high)
Rank 4Craft CMS
CVE-2025-35939Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability
Added more than a year ago: ranked by severity.
- Added
- Jun 2, 2025
- CISA deadline
- 21 days
- CVSS severity
- 5.3 (medium)
Follow and verify
Indicative classification, based on the vendor and product names given by CISA. How products are classified.