A reflected cross‑site scripting flaw exists in the /admin/menus component of LightCMS 2.0, allowing an attacker to inject and execute arbitrary JavaScript by modifying the Referer header of a request. This can lead to session hijacking, data exfiltration, or defacement while an administrator is authenticated.

The vulnerability affects LightCMS version 2.0 from the LightCMS Project. No other vendors or products are listed.

With a CVSS base score of 6.1 the risk level is moderate, and an EPSS score below 1% indicates a low likelihood of exploitation. The flaw is not included in the CISA KEV catalog. Exfiltration requires an attacker to lure a logged‑in administrator to visit a crafted URL that sets the Referer header to a malicious payload, enabling the attacker to run scripts with administrative privileges.