October CMS versions before 3.7.14 and 4.1.10 store email preview content directly in an iframe that lacks a sandbox, allowing embedded JavaScript to run in the viewer’s browser. This stored XSS can be used to hijack user sessions, steal cookies or perform other malicious actions within the context of the victim’s administrative session, impacting confidentiality and integrity of the CMS data.

October CMS products released before version 3.7.14 or 4.1.10 are vulnerable. Administrators and users who can access the Event Log mail preview feature are directly affected.

The CVSS score of 5.1 indicates medium severity. No EPSS score is available, and the vulnerability is not currently listed in CISA’s KEV catalog, suggesting there is no widely known exploit at present. Exploitation requires the attacker to have authenticated access to a user who can view the mail preview in the Event Log; if such access is obtained, the stored JavaScript can execute without further user interaction. Because the flaw is only triggered when the preview is rendered, the attack surface is limited to users with permission to view the Event Log.