The flaw resides in gougucms up to 4.08.18 in the Add action of app/admin/controller/Level.php. By supplying a crafted Title parameter, a malicious user can inject JavaScript that executes in the browser of anyone who views the affected resource. This is a classic cross‑site scripting flaw identified as CWE‑79. The vulnerability can be triggered through a remote HTTP request, and the CVE data does not state whether authentication is required, so the scope of affected users remains uncertain.

The affected product is gougucms, all releases up to version 4.08.18. No information is given for newer releases, so any deployment of these or earlier versions is potentially vulnerable.

The CVSS score of 4.8 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV, giving no evidence of widespread exploitation. The attack vector is remote via crafted HTTP requests that include a malicious Title parameter. Because the CVE description states the exploit can be carried out remotely, but does not describe any authentication requirement, it is uncertain whether the flaw is exploitable without prior authentication.