A reflected Cross‑Site Scripting flaw exists in Alkacon OpenCms 18.x, triggered by the 'q' query parameter in the /search/index.html page. The attacker can embed malicious JavaScript in a crafted URL that executes in the victim’s browser, allowing the theft of session cookies and impersonation of the user.

Alkacon’s OpenCms versions 18.0.0 and 18.0 are vulnerable; any deployment running these releases without the fix is exposed.

The CVSS base score of 5.1 indicates moderate severity, while the EPSS of <1 % suggests a low likelihood of exploitation, and the flaw is not listed in CISA's catalog of known exploited vulnerabilities. Exploitation requires only a malicious URL sent to a target, with no authentication or privileged access needed. If exploited, attackers can hijack sessions and perform actions as the victim, representing a medium threat to users who rely on the public search functionality.