A stored cross‑site scripting flaw exists in the Forums feature of OpenText Content Management Content Server. The flaw allows a malicious actor to inject arbitrary JavaScript into a forum web page, which will execute in the browsers of users who view the page. This can lead to data theft, session hijacking, or defacement of the site, and represents a medium‑severity vulnerability classified as CWE‑79.

The vulnerability affects the OpenText Content Management suite, specifically the Forums component. No specific product versions are listed in the published data, so all installations of this component remain potentially vulnerable until an update is applied.

The CVSS score of 5.3 indicates moderate impact. Tool‑based exploit probability data (EPSS) is not available, so the likelihood of widespread exploitation cannot be quantified. The vulnerability is not currently listed in CISA’s KEV catalog, suggesting no known widespread abuse. Based on the description, the attack likely requires a victim to view a forum page; no explicit authentication requirements are stated, so the vector is inferred to be client‑side delivery of malicious code.