Raytha CMS suffers from a reflected cross‑site scripting (XSS) flaw in the logon feature through the returnUrl parameter. When an authenticated user follows a specially crafted URL, the application inserts the unescaped returnUrl value into the page, allowing an attacker to inject and execute arbitrary JavaScript in the victim’s browser. This can lead to theft of credentials, session hijacking, or other malicious client‑side actions.

The vulnerability is present in all Raytha CMS releases prior to version 1.4.6. The affected product is Raytha CMS, as identified by the vendor and the CPE string cpe:2.3:a:raytha:raytha:*:*:*:*:*:*:*. Attackers can exploit any deployed instance of these earlier versions via the logon flow.

The CVSS score of 5.1 indicates a medium severity impact, while the EPSS score below 1% shows a low probability of widespread exploitation. The flaw is not listed in CISA’s KEV catalog, implying no confirmed large‑scale exploitation reports. Exploitation requires an authenticated user to click a malicious link and the attacker must be able to provide the crafted URL; thus the damage is limited to the scope of that logged‑in account. Organizations using pre‑1.4.6 releases should apply the vendor fix promptly to eliminate the risk of client‑side compromise.