This vulnerability arises from improper handling of user content in the Article module’s fix_html function, allowing an attacker to inject malicious script code that is permanently stored and rendered in later page views. The direct result is a Stored Cross‑Site Scripting flaw that can compromise user browsers, steal session cookies, or execute arbitrary code within the site context. The description indicates that exploitation is possible from a remote location, and the exploit has already been publicly disclosed and is known to be usable.

The flaw affects the WeRSS we‑mp‑rss product from rachelos, specifically any release up to version 1.4.8. All deployments that include the Article module and its fix_html helper in these versions are susceptible to the stored XSS exposure.

The CVSS score of 5.1 places this vulnerability in the moderate category, while the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog, but because the flaw permits remote code execution via stored script payloads and has already been publicly disclosed, organizations should not dismiss it as insignificant. The primary attack vector is remote, likely delivered through crafted article submissions that leverage the unescaped output of the fix_html function.