This flaw occurs in JiZhiCMS version 2.5.6 and earlier within the release function of the user controller. The input sanitization removes <script> tags but leaves dangerous attributes such as onerror on <img> tags untouched. An authenticated attacker can submit a POST request to /user/release.html with a crafted body that contains malicious JavaScript or HTML, which is then stored and executed in the browser context of any user who views the content, enabling client‑side data theft, session hijacking, or page defacement.

JiZhiCMS, particularly versions 2.5.6 and before, are impacted. No additional vendors or products were identified by the CNA. The vulnerability is referenced by the CPE string jizhicms:jizhicms.

The CVSS base score of 5.4 indicates medium severity, while the EPSS score of less than 1% points to a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the CMS, limiting the attack surface to privileged users. The primary consequence is that arbitrary client‑side code can be injected and executed in the browsers of other logged‑in users.