A reflected Cross‑Site Scripting flaw allows an attacker to inject and execute arbitrary JavaScript when a login attempt fails, because the supplied username is echoed back without proper encoding. The impact includes theft of session cookies, defacement, or redirection of the victim to malicious sites.

The vulnerability affects the Typemill flat‑file CMS from vendor Typemill. Versions 2.19.1 and older are vulnerable; the issue was remedied in release 2.19.2.

The CVSS score of 5.4 indicates moderate severity. EPSS shows an exploit likelihood of less than 1 %, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that the attacker crafts a link to the login page with a malicious username that will be reflected back, or sends phishing emails prompting the victim to log in. Based on the description, the attacker can only target users who visit the vulnerable login page after a failed authentication attempt, thus requiring the victim to be prompted to enter credentials. Because it is a reflected XSS, the exploit is limited to browsers executing the injected script in the context of the login page and cannot affect other users or the server.