NewsLister suffers an authenticated persistent cross‑site scripting vulnerability that allows administrators to inject JavaScript payloads through the title field when creating news items. When other users view the affected news, the malicious script executes in their browsers, potentially compromising session data, defacing content, or facilitating further attacks. This weakness is classified as CWE‑79.

The affected product is Netartmedia NewsLister. No specific versions are listed in the CNA data, so all installations of this product remain vulnerable until patched or otherwise mitigated.

The CVSS score of 5.1 indicates moderate severity. No EPSS score is available, and the vulnerability is not present in the CISA KEV catalog. Exploitation requires authenticated administrator credentials, which limits the attack surface but still poses a significant risk to any organization that grants broad admin privileges. Once an attacker defends the title field with JavaScript, the impact spans all users who read the news items.