W (vincent‑peugnet/wcms) versions through 3.18.0 contain a stored cross‑site scripting flaw that permits an unauthenticated attacker to insert script code into the login username and visitor comment fields. When a login attempt fails, the supplied username appears unescaped in adminlog.php, and when a comment is posted, the comment URL is echoed within an href attribute in editrightbar.php. The injected code executes with the privileges of any administrator or editor who views the affected page, allowing an attacker to hijack sessions, modify site content, or inject further malicious actions.

The vulnerability affects all deployments of wcms from the vincent‑peugnet organization running version 3.18.0 or earlier. Any installation that has not upgraded beyond 3.18.0 is impacted.

The CVSS score of 5.3 classifies the flaw as moderate. No EPSS score is available and it is not listed in the CISA KEV catalog. Attackers do not need to be authenticated; they simply submit a crafted payload through the login form or comment post, and the data is later rendered without encoding in privileged admin pages. Exploitation is straightforward and does not require specialized conditions.