The vulnerability is a Stored XSS in the PluXml CMS file‑uploading component. An attacker with CMS credentials can upload a specially crafted SVG file that contains malicious JavaScript. When a user visits or clicks the link to that image, the browser executes the injected code, potentially allowing the attacker to hijack the victim’s session, steal cookies, or perform actions on the site under that user’s authority.

The attack is limited to PluXml CMS. Versions 5.8.21 and 5.9.0‑rc7 have been confirmed vulnerable. Other releases have not been tested but might contain the same flaw, so administrators should treat all unreleased or earlier versions with caution.

The CVSS base score is 5.1, indicating moderate severity. The EPSS score is less than 1 %, implying a very low public exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated access to the CMS to upload the SVG file and a subsequent user interaction with the link. Thus the threat is confined to privileged uploaders or attackers who have obtained legitimate CMS credentials. As no public exploit has been reported, the immediate risk is low, but the potential impact remains high if an attacker compromises a user account.