This vulnerability allows the injection of arbitrary script code into blog pages and exception pages, enabling attackers to compromise user sessions or steal sensitive information. It is an example of cross‑site scripting, a commonly exploited weakness that can lead to data theft, session hijacking, or further attacks. The CVE highlights that the flaw is present in all versions of Frappe prior to 14.49.0, and relies on the application’s insufficient sanitization of user‑supplied input.

All deployments of the Frappe application before the 14.49.0 release are affected. This includes every site or instance that uses the default blogging functionality or displays exception pages for end users. Administrators should verify that their version of Frappe falls below the patched release.

The modest CVSS score of 6.1 indicates a moderate severity. The EPSS score is below 1%, indicating a very low but non‑zero exploitation probability. It is not listed in the CISA KEV catalog, so widespread exploitation has not been confirmed. The likely attack vector is a web‑based one where an attacker supplies specially crafted input or URLs to blog or error pages, which are then rendered with the injected script.