HAX CMS versions 11.0.6 up to (but not including) 25.0.0 contain a stored cross-site scripting flaw that allows an attacker to inject malicious script into the CMS database. The injected payload can execute in the context of authenticated users, potentially enabling the theft of user credentials or direct takeover of their administrative accounts. This vulnerability is classified as CWE-79 and provides a direct path from a content author or user with write permissions to an attacker gaining persistent access to privileged sessions.

The issue affects the haxtheweb haxcms-nodejs product. All installations of version 11.0.6 through 24.x.x are vulnerable; the fix was released in v25.0.0. No other products or versions are indicated as impacted.

The CVSS score is 8.1, indicating a high severity. The EPSS score is below 1%, suggesting a low current probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web-based: an attacker logs into the CMS (or obtains a user account with authoring rights), injects malicious script through a content field, and later an authenticated user views that content, causing the payload to run in their browser. This execution then allows the attacker to hijack the session or exfiltrate information.