CMS Made Simple 2.2.15 is vulnerable to a stored cross‑site scripting flaw that is triggered when an authenticated user with Content Manager privileges uploads an SVG file containing embedded JavaScript. When another authenticated user opens the uploaded file via the file manager, the injected script executes in the victim’s browser, allowing attackers to steal session cookies and hijack the user’s session.

This issue affects CMS Made Simple 2.2.15; the vulnerability is present in versions that include buggy SVG upload handling, and the product has been listed under the vendor name CMS Made Simple.

The CVSS score of 5.1 indicates a medium severity vulnerability, and no EPSS data is available. The attack requires legitimate user credentials and advanced role permissions; if an attacker can obtain or reuse such credentials, they can upload malicious SVG files. Because the vulnerability is not listed in the CISA KEV catalog, no known zero‑day exploitation is confirmed, but the potential for widespread session hijacking exists if the upload module is left unprotected.