GetSimpleCMS Community Edition versions prior to 3.3.22 contain a stored cross‑site scripting flaw in the Theme to Components feature within components.php. The vulnerability arises because user‑supplied data in the slug field of a component is written to XML without proper output encoding. The other component fields are sanitized with safe_slash_html(), but the slug is stored and later rendered in the administrative interface unsanitized, causing persistent execution of arbitrary JavaScript. An authenticated administrator can inject malicious script into the slug, which runs whenever the affected component page is viewed by any authenticated user, allowing session hijacking, unauthorized administrative actions, and ongoing compromise of the CMS administration interface.

The affected vendor is GetSimpleCMS Community Edition. Vulnerable releases include all versions prior to 3.3.22 (e.g., 3.3.16) and have been confirmed to contain the flaw, while version 3.3.22 and later are no longer vulnerable.

The flaw has a CVSS v3.1 base score of 4.8, indicating moderate severity. EPSS shows a very low exploitation probability (< 1%), and the vulnerability is not listed in CISA’s KEV catalog. Attack requires an authenticated administrator who can create or edit a component with a malicious slug value; once stored, the payload is executed whenever other authenticated users view the component page. Based on the description, it is inferred that non‑authenticated users cannot exploit the flaw directly, but the impact becomes significant once administrative privileges are gained.