ApostropheCMS validates color fields by allowing any string that begins with a valid rgb() or hsl() prefix; the validation does not enforce that the entire input matches a color. As a result, an authenticated user can append arbitrary HTML after the prefix and store it as the color value. When the stored value is rendered on a page, the injected HTML executes in the visitor’s browser, producing a stored XSS vulnerability. The flaw is a classic example of a CWE‑79 weakness, where improper output encoding leads to script injection.

All instances of ApostropheCMS version 4.33.x or earlier contain the buggy color field. The flaw resides in the apostrophecms:apostrophe component, which is the core CMS front‑end and back‑end code. Users running any of those releases are vulnerable unless a later version or a patch is applied.

The CVSS score of 5.4 indicates a moderate risk, and the EPSS score is currently unavailable, making it unclear how frequently the flaw is exploited. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to possess editing rights to the content; an authenticated editor can supply the malicious value, and any visitor to the page where the value is displayed will run the payload. Although it does not provide remote code execution outside the browser, XSS can lead to credential theft or phishing, escalating the threat to the system. The likelihood of exploitation is expected to be low to moderate given the credential requirement, but it remains a valid concern for environments that rely on untrusted editors or expose the CMS to wide audiences.