Raytha CMS is vulnerable to reflected cross‑site scripting through the backToListUrl parameter. An attacker can craft a malicious URL that, when opened by an authenticated victim, causes arbitrary JavaScript to execute in the victim’s browser. This weakness is identified as CWE‑79.

The affected product is Raytha CMS (vendor Raytha). All releases prior to version 1.4.6 contain the vulnerability; deployments running earlier versions remain at risk until updated.

The CVSS score of 5.1 indicates moderate severity, while an EPSS score of less than 1% shows a low probability of active exploitation. The issue is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user to click a crafted link, so the most likely attack vector is a phishing or malicious link sent to a valid user. Applying the available patch mitigates the risk entirely.