GetSimpleCMS Community Edition version 3.3.16 contains a stored cross‑site scripting vulnerability in components.php. User‑supplied input passed to the slug field is written to XML and later rendered in the admin interface without proper output encoding, resulting in persistent execution of arbitrary JavaScript. This type of flaw permits an authenticated administrator to inject malicious script that runs whenever the affected Components page is viewed by any authenticated user, enabling session hijacking, unauthorized administrative actions, and persistent compromise of the CMS administrative interface.

The affected vendor is GetSimpleCMS Community Edition. Vulnerable releases include version 3.3.16 and all earlier releases prior to 3.3.22, which has been confirmed to not contain the flaw.

The flaw carries a CVSS v3.1 base score of 4.8, which falls into the moderate severity range. EPSS indicates a very low probability of exploitation (< 1%), and the vulnerability is not currently catalogued in CISA’s KEV. The most likely attack scenario requires an authenticated administrator to create or edit a component with a malicious slug value; the payload is then stored and executed whenever the component page is accessed by other authenticated users. Because the vulnerability is tied to administrative privileges, non‑authenticated users cannot exploit it directly, but once a user gains administrative rights they can perform arbitrary actions in the CMS.