The flaw is a reflected cross‑site scripting vulnerability in u5CMS versions up to 12.8.8 that arises from unsanitized handling of the “thanks” parameter in multiple form components. The input is reflected back into the resulting HTML, allowing an attacker to embed arbitrary JavaScript code that runs in the browsers of users who vulnerability is classified as CWE‑79, Improper Neutralization of Input During Web Page Generation.

u5CMS content management systems built with versions 12.8.8 and earlier are affected. The CVE does not specify an official fix, but users should verify whether a recent release contains remediation.

The CVSS score of 6.4 places the vulnerability in the Medium severity range. The EPSS score is below 1%, indicating a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted POST request to any public form that includes the “thanks” field. Based on the description, it is inferred that a victim must load the reflected page in their browser for execution to occur, so user interaction is required.