The vulnerability is a Cross‑Site Scripting flaw located in the page parameter of tiki‑editpage.php. It allows an attacker to inject and execute arbitrary JavaScript in the browser of any user who views the affected page, potentially enabling theft of session data, impersonation, or execution of unauthorized actions on the victim's behalf. This flaw corresponds to CWE‑79 and can compromise the confidentiality and integrity of user information.

The issue impacts all Tiki CMS releases 26.3 and earlier. Any installation running those versions is vulnerable until the security update for the 27.x or newer LTS releases is applied.

With a CVSS score of 5.4 the vulnerability is considered moderate in severity. The EPSS score is below 1%, indicating that exploitation is unlikely to be widely used, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. It is inferred that the attack vector would be through a crafted URL or form submission targeting the page parameter, potentially affecting both authenticated and unauthenticated users depending on configuration. No public workaround is documented, so the only viable mitigation is to remove the vulnerable code by upgrading the CMS.