REDAXO versions prior to 5.21.4 suffer a stored cross‑site scripting flaw that allows content editors to embed malicious HTML by supplying specially crafted REX_INPUT_MEDIA or REX_INPUT_LINK values. These inputs bypass normal escaping, causing the output to break out of the value attribute of the media and link widgets and execute JavaScript when the backend is rendered. An attacker who can control the content editor role can therefore run arbitrary scripts inside an administrator’s session, which can lead to credential theft or account hijacking.

The vulnerable product is REDAXO core. Versions before 5.21.4 are affected; versions 5.21.4 and newer contain the fix.

The CVSS score of 5.1 indicates a moderate risk, but the exploitation would require access to the content editor interface. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. Nonetheless, attackers can hijack administrative sessions if they can inject the malicious input, making remediation advisable.