Carbon Forum 5.9.0 has a persistent cross‑site scripting flaw that permits authenticated administrators to insert arbitrary JavaScript into the Forum Name field of the dashboard settings. The stored script runs in every visitor’s browser when they view the forum, allowing an attacker to hijack user sessions and exfiltrate sensitive information. The weakness stems from unvalidated input and improper output encoding (CWE‑79).

The vulnerability affects the Carbon Forum 5.9.0 release from the 94Cb vendor. No other versions are listed in the current data. Users running this exact version are directly impacted.

With a CVSS score of 5.1, the vulnerability is classified as Medium severity. An exploit requires that the attacker already have administrative access to the forum; it cannot be triggered by unauthenticated users. Because the EPSS score is not available and the issue is not in CISA’s KEV catalog, the likelihood of widespread exploitation is uncertain, but privileged accounts are at risk if they are compromised or if attacker accounts are mistakenly granted admin rights.