The flaw resides in pageEditMember.php of Fantastic Blog CMS 1.0. An attacker who can submit form data to the address field can inject arbitrary script that will run in the browser of any user visiting the page. This XSS can be leveraged to steal session cookies, deface content or redirect users to malicious sites. The vulnerability is an instance of reflected or possibly stored cross‑site scripting as the address field is not sanitized before rendering.

Sourcecodester Fantastic Blog CMS 1.0 is affected. No additional vendor or product variations are listed, and no patch level is specified beyond the 1.0 release.

The CVSS score of 6.1 indicates a medium risk. The EPSS score is under 1 %, implying a low likelihood of exploitation at the time of this analysis. The vulnerability is not listed in CISA KEV. An attacker can exploit it by visiting the pageEditMember.php page with a crafted address value, assuming the user is authenticated or the page is publicly accessible. Successful exploitation would allow client‑side script execution within the context of the site.