A persistent cross‑site scripting flaw exists in Composr CMS 10.0.34 that permits authenticated administrators to inject malicious script payloads into the Description field when adding banners. The payload is stored and served to every site visitor on the home page, allowing attackers to steal cookies, deface the site, or redirect users to malicious sites. The weakness is a classic XSS flaw (CWE‑79) that compromises the confidentiality and integrity of all site visitors.

Composr CMS version 10.0.28 to 10.0.34 are affected. Administrators of any site running these releases are vulnerable when using the banner management feature.

The CVSS score of 5.1 indicates a moderate severity. Exploitation requires administrative authentication, limiting the attacker to compromised or weakly protected admin accounts. No exploit probability score is available, and the vulnerability is not listed in the CISA KEV catalog. While attackers can impact all users who view the homepage, the risk is constrained to sites where admins have not been secured or who use the banner feature.