October CMS versions before 3.7.14 and 4.1.10 embed unsanitized input from the Markup Classes fields into the Froala editor dropdowns. The vulnerability allows a user to place malicious JavaScript payloads in CSS class attributes. When a user with editor setting permissions opens a RichEditor, the script runs in the victim’s browser, potentially leading to higher privilege use or session hijacking. The weakness is a stored cross‑site scripting flaw.

The flaw impacts October CMS products from the October vendor, specifically all releases older than 3.7.14 and 4.1.10. Any deployment of these versions that allows editing of content via the Backend Editor is susceptible unless the editor settings permissions have already been restricted to trusted administrators.

The CVSS base score is 5.1, indicating moderate severity. Exploitation requires authenticated backend access with editor settings permissions, so the likelihood is limited to users granted those rights. No EPSS score is reported, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is therefore constrained to legitimate administrators; however, the impact could allow privilege escalation if a superuser triggers the vulnerable editor. The known fix exists in the stated versions, and in its absence a corrective workaround can be applied by limiting editor settings permissions.