This vulnerability arises in the PaginatorHelper::limitControl() method when a query string parameter is used directly in output without proper sanitization. The flaw permits an attacker to insert malicious script code that will be reflected back to the browser, enabling cross‑site scripting attacks. The immediate consequence is the compromise of the victim’s browser session, potential credential theft or defacement.

The flaw affects CakePHP, version 5.2.x and 5.3.x. Versions 5.2.12 and 5.3.1 contain the fix. The affected product is the CakePHP framework used in PHP web applications, particularly any installation that processes pagination limits via the limitControl helper.

The CVSS score of 5.4 denotes moderate risk, and the EPSS score of less than 1% indicates a very low likelihood that the vulnerability is being actively exploited. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. Attackers could exploit the flaw by crafting a malicious URL containing JavaScript payloads in the limit parameter, which would be shown to other users clicking the link. Successful exploitation would allow an attacker to run arbitrary client‑side scripts in the context of a victim’s session, but it does not lead to remote code execution or server compromise.