In baserCMS, global shortcode expansion runs after the entire page is rendered, which includes HTML‑escaped blog comments submitted by unauthenticated visitors. A comment containing the BcBaser.getGoogleMaps shortcode can set an apiBaseUrl to an attacker‑controlled script URL; the shortcode expansion emits this URL as a script tag that loads and executes code as the site’s origin. Because comments are stored and later processed, the XSS is stored and can target any visitor or administrator who opens the affected article. Other shortcodes are also vulnerable; Mail.getForm can embed a contact form with a valid CSRF token, further enabling potential credential theft or session hijacking.

The vulnerability affects baserCMS versions 5.0.0 through 5.3.1 and 5.4.0 through 5.4.1. These releases run the global shortcode expansion on all page content, including user‑supplied comments.

The CVSS score of 7.1 indicates a moderate‑to‑high impact threat, and no EPSS data is available, implying low publicly reported exploitation. The flaw is not listed in CISA’s KEV catalog. An attacker can exploit the issue by simply submitting a malicious comment on a public blog page; once an administrator or another visitor opens the affected article, the attacker’s code runs in the context of the site. The attack requires only unauthenticated comment submission and a subsequent page view. The likely attack vector is unauthenticated remote exploitation via the comment form, followed by local execution of malicious JavaScript in the browser of an authenticated administrator.