A stored cross-site scripting flaw exists in content titles of Statamic CMS versions 6.0.0 through the pre-6.2.3 releases. When an authenticated user with content creation permissions injects malicious JavaScript into a title, the code runs in the context of higher‑privileged users who view that content. The injected script can exploit the system to create new super administrator accounts, effectively allowing an attacker to elevate their privileges. This weakness is identified as a Reflected Cross‑Site Scripting issue (CWE‑79).

The vulnerable application is Statamic CMS, a Laravel‑based content management system. All releases from version 6.0.0 up to but not including 6.2.3 are affected. Those operating these editions should verify the installed version and plan an update where applicable.

The CVSS score of 8.7 indicates a high severity vulnerability. However, the EPSS score is below 1%, suggesting a low probability of exploitation at the time of analysis, and the issue is not listed in the CISA KEV catalog. Exploitability requires the attacker to have a control‑panel account with content‑creation rights. Once authenticated, the attacker can inject malicious titles; when a higher‑privileged user views the content, the embedded script executes, enabling the creation of super‑admin accounts. The real‑world risk is therefore high for environments where content creation permissions are granted to untrusted users, but the exploitation window is limited by the authentication and role constraints outlined above.