PluXml CMS contains a stored cross‑site scripting flaw in the static pages editing workflow. Content editors can embed arbitrary HTML or JavaScript that is saved in the database and served unfiltered to any visitor. Because the payload is rendered as part of the page, a successful exploit enables an attacker with editing rights to execute scripts in the context of any user who views the contaminated page, potentially allowing credential theft, defacement, or malicious redirects.

The vulnerability affects the PluXml CMS platform, specifically the versions that have been confirmed to be vulnerable: 5.8.21 and 5.9.0‑rc7. While other releases have not been tested, they may also contain the flaw. The affected component is the static pages editing interface, which is part of the core application supplied by PluXml.

The CVSS score of 5.1 indicates moderate impact, and an EPSS below 1% suggests low exploitation probability so far. The vulnerability is not currently catalogued in CISA's KEV list. Attackers need at least editing privileges to inject the payload; if such privileges are available – either through compromised accounts or mis‑configured access – the exploit chain is straightforward: the attacker submits malicious content, which the CMS stores and later serves to visitors. No additional network or local privilege escalation is required beyond the editing role.