PluXml CMS Stored Cross-Site Scripting Vulnerability in Static Pages Editing

A stored cross-site scripting vulnerability has been identified in PluXml CMS versions 5.8.21 and 5.9.0-rc7. This issue arises in the static pages editing feature, where an attacker with editing privileges can inject arbitrary HTML and JavaScript. The injected content is executed when the edited page is viewed. While only these two versions have been confirmed vulnerable, other versions may also be affected.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the page.