Windu CMS Stored Cross-Site Scripting Vulnerability in Page Editing Endpoint

A stored cross-site scripting vulnerability has been identified in Windu CMS version 4.1, specifically within the page editing endpoint. This issue allows a privileged user to inject malicious scripts that are executed when other users with higher privileges access the affected page. While the vendor was notified about this vulnerability, they did not provide details regarding the vulnerable version range. Only Windu CMS version 4.1 has been tested and confirmed as vulnerable, leaving the status of other versions uncertain.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the page.