The flaw resides in the Task Scheduling Management Module of CicadasCMS, specifically within ScheduleJobController.java. An attacker can supply crafted input that is rendered without proper escaping, resulting in arbitrary JavaScript execution in the context of a victim’s browser. This injects malicious scripts that could steal session tokens, deface pages, or redirect users. The vulnerability is exploited remotely over the network, and the public has released an exploit that demonstrates the attack surface.

All installations of westboy CicadasCMS up to the git revision 2431154dac8d0735e04f1fd2a3c3556668fc8dab are affected. Due to the rolling‑release model, the product does not publish discrete version numbers, so any deployed instance prior to the fix is vulnerable.

The CVSS score of 4.8 indicates a moderate severity level. The EPSS score is not available, making the likelihood of exploitation unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers can remotely trigger the XSS by accessing the scheduling endpoint with a specially crafted payload; no privileges or local access are required. Once exploited, the damage is limited to the victim’s browser context but can lead to credential theft or session hijacking.