The vulnerability permits authenticated users of GetSimple CMS to upload SVG files that contain malicious JavaScript. Because the CMS does not sanitize or restrict SVG content, the script is embedded in the file. When a user accesses the uploaded file, the malicious script runs in that user’s browser, enabling stored cross‑site scripting.

GetSimpleCMS‑CE Community Edition. All versions of the community edition are affected. No specific version numbers are supplied; the vulnerability exists in every released build of the CMS at the time of this advisory.

The CVSS score is 6.9, indicating a moderate severity. The EPSS score is below 1%, suggesting that, statistically, exploitation is unlikely at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker must first authenticate to the CMS and be granted upload privileges to place a malicious SVG; after that, any user who opens the file will trigger script execution. Because no patch is available, the risk remains until a vendor release addresses the issue.