wCMS Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability exists in wCMS version 1.4, specifically when users create a new blog. The issue allows for the injection of malicious scripts that could be executed in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, create a new blog post in wCMS version 1.4. Insert a payload that includes an image tag with an 'onerror' event, such as an image source set to '1'. When the blog post is saved and viewed, the injected script will execute, demonstrating the cross-site scripting vulnerability.