A cross‑site scripting vulnerability exists in the BaykeShop Article Sidebar Module. By manipulating the value of sidebar.content within the custom.html template, an attacker can inject arbitrary scripts that the browser will execute when a user browses the page. The flaw is a classic reflected XSS (CWE‑79) that also involves the generation of executable code through user input (CWE‑94). Attackers could hijack user sessions, deface pages or perform phishing attacks.

Vendors: xingfuggz. Product: BaykeShop version 1.3.20 and earlier. The issue is tied to the file src/baykeshop/contrib/article/templates/baykeshop/sidebar/custom.html within the Article Sidebar Module. No later versions are known to be impacted.

The CVSS base score of 4.8 classifies the flaw as moderate. EPSS indicates a very low probability of exploitation, with a value below 1 %. It is not currently listed in CISA’s KEV catalog. The exploitation method requires remote access to the controller handling sidebar.content, meaning a vulnerable site can be attacked without authentication if the content is publicly reachable. Because the payload is executed in the victim’s browser, successful exploitation could lead to session theft or other client‑side attacks.