Verified detail: Customizable content editing backend.
Editorial sites and structured publishing.
| Verified detail | Customizable content editing backend |
|---|---|
| Best suited to | Editorial sites and structured publishing. |
| Before you commit | Before choosing: who handles hosting, security updates and backups? |
| Pricing & plans | Free license; hosting billed separately Official website ↗ |
| Source | craftcms.com ↗ |
Oct 21, 2026
Craft CMS Tutorial, Part 1: Introduction · CraftQuest
Free license; hosting billed separately
| Team | USD 279 / month |
|---|
Software license only; hosting and operations cost extra.
Pricing & plans ↗| Country | Live websites |
|---|---|
| 🇺🇸 United States | 11,363 |
| 🇬🇧 United Kingdom | 4,812 |
| 🇧🇪 Belgium | 2,833 |
| 🇨🇭 Switzerland | 2,751 |
| 🇳🇱 Netherlands | 2,738 |
| 🇩🇪 Germany | 2,501 |
| 🇦🇺 Australia | 2,124 |
| 🇳🇴 Norway | 1,131 |
| 🇨🇦 Canada | 1,035 |
| 🇧🇷 Brazil | 32 |
Live websites detected by BuiltWith. Leading countries; partial coverage. · Source ↗
| Company name | Pixel & Tonic, Inc. |
|---|---|
| Country | United States |
Craft 3 introduced multisite publishing and Composer distribution, while a Plugin Store expanded its commercial extension ecosystem.
Craft 4 improved editorial accessibility, draft management and user permissions, requiring projects to plan a major-version upgrade.
Craft disclosed unauthenticated remote code execution, CVE-2023-41892, fixed in version 4.4.15; the advisory did not establish a confirmed breach.
Craft 5 expanded content modeling through nested entries and a redesigned authoring interface, alongside a new Team edition.
Craft Cloud launched first-party serverless hosting, combining deployments, databases, image transforms, queues and a global content-delivery network.
Craft found evidence that CVE-2025-32432 was being exploited and warned affected license holders to update or install emergency security patches.
Craft published CVE-2023-41892 affecting 4.0.0-RC1 through 4.4.14, fixed in 4.4.15. The maintainer advised rotating potentially exposed keys. This is the disclosure date, not the patch release date or a confirmed breach date.
Source ↗Before choosing: who handles hosting, security updates and backups?
Your practical checklist
An open-source CMS with themes, plugins and control over your own hosting.
Languages: Four multilingual modules in core.
Verified detail: Multilingual CMS with multi-user permissions.
Verified detail: Democratically governed open-source CMS project.
