OpenSolution QuickCMS Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in OpenSolution QuickCMS versions prior to 6.8. The issue arises from an insecure HTTP-based plugin-fetching mechanism, which allows attackers to perform man-in-the-middle (MITM) attacks. By impersonating the opensolution.org server, an attacker can deliver arbitrary HTML or JavaScript to the plugin list endpoint. When a user visits the plugin page, the malicious content is automatically retrieved, displayed, and executed. This vulnerability was addressed in version 6.8, released on May 15, 2026.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can update to QuickCMS version 6.8 to address this vulnerability.