The vulnerability is a reflected cross‑site scripting flaw in the REDAXO core before version 5.21.0. An attacker who is authenticated to the system can supply a malicious payload in the "type" parameter of the metainfo_default_fields_create API. The renderer rex_view::message() processes this payload without escaping, causing the script to run in the victim's backend session. Attackers can thus inject arbitrary JavaScript that executes in the context of authenticated administrative users.

REDAXO core versions earlier than 5.21.0 are affected. Any instance of REDAXO installed with a version number lower than 5.21.0 that exposes the metainfo API is vulnerable, regardless of the specific deployment environment.

The CVSS score of 2.1 indicates a low severity. Exploitation requires an attacker to be authenticated and to possess a valid CSRF token, which can be crafted into a link that forces the vulnerable component to render the unescaped payload. The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, implying no documented widespread exploitation to date. Nevertheless, because the flaw permits script execution within an administrative interface, it can be leveraged to steal session cookies or manipulate page content, warranting timely mitigation.