Connect-CMS Stored Cross-Site Scripting Vulnerability in Form Plugin File Field

A stored cross-site scripting vulnerability has been identified in Connect-CMS versions 1.x prior to 1.41.0 and 2.x prior to 2.41.0. The issue resides in the file field of the Form Plugin, where arbitrary scripts could be executed in the context of an administrator's browser, potentially leading to unauthorized actions or information theft.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected content.

Remediation

Users should update to version 1.41.1 or later for the 1.x series, and to version 2.41.1 or later for the 2.x series.