The vulnerability resides in the Blocks Endpoint of Intelliants Subrion CMS versions up to 4.0.3. By altering the CSS class name argument sent to the endpoint, an attacker can inject malicious script code. This flaw enables a reflected cross‑site scripting (XSS) attack that will execute when a victim visits the affected page. The CVE notes that the attack can be performed remotely and has been publicly disclosed.

Intelliants Subrion CMS versions up to 4.0.3 are affected; any deployment exposing the Blocks Endpoint is vulnerable.

The CVSS base score of 4.8 indicates moderate severity. EPSS is not available, and there is no KEV designation. The vulnerability is publicly disclosed and can be triggered via an HTTP request to the vulnerable endpoint, so exposed systems face a measurable risk. The impact is client‑side script execution; it does not provide server‑side compromise, but can lead to credential theft, session hijacking, or defacement if executed in a user‑browser context.