baserCMS, prior to version 5.2.3, includes a cross‑site scripting vulnerability in the blog post component. An attacker who can insert malicious code into a blog entry can cause that code to be executed in the web browsers of any visitor who views the post. The flaw, classified as CWE‑79, allows arbitrary script execution on the client side, which can compromise the confidentiality and integrity of user data displayed by the site.

All installations of baserCMS with a version earlier than 5.2.3 are affected. The vendor released a patch in version 5.2.3 that removes the vulnerability; newer releases are not susceptible.

The CVSS score of 6.9 indicates a medium severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker requires the ability to create or edit blog posts, which may require authenticated authoring privileges. Because the malicious script would run in the browsers of all site visitors, the practical impact can be significant for sites that allow open or lightly protected posting authority. The overall risk is moderate but warrants prompt remediation.