The vulnerability is a stored cross‑site scripting flaw in Alkacon's OpenCms version 18.0, caused when a user’s input in the ‘text’ parameter of a POST request to /blog/new-article/org.opencms.ugc.CmsUgcEditService.gwt is not validated. An attacker could inject script that runs in the browsers of any user who views the affected content, potentially enabling session hijacking, credential theft, defacement, or execution of arbitrary queries on behalf of the site’s users. This flaw is identified as CWE‑79.

This issue affects Alkacon’s OpenCms product at version 18.0.0, and all 18.x releases that have not been patched. The Alkacon team has released a fix in version 19.0, which removes the vulnerability.

The flaw has a CVSS score of 5.1, indicating moderate severity. Because the EPSS score is below 1% and the vulnerability is not included in CISA’s KEV catalog, widespread exploitation is unlikely at present. The attack vector is local to the web front‑end, requiring an attacker to supply malicious input through the blog posting interface; however, any user who later views the stored content can be affected. The risk is greatest for sites that allow unauthenticated or publicly editable blog posts.