The vulnerability is a cross‑site scripting flaw in baserCMS’s blog post functionality. User‑supplied content that appears in a post is not sanitized, allowing an attacker to embed malicious JavaScript. When another visitor loads the compromised post, the script executes in that user’s browser and can steal cookies, deface the page, or trigger further client‑side attacks.

All installations of baserCMS built on baserproject prior to version 5.2.3 are vulnerable. The flaw was fixed in release 5.2.3; sites running that version or newer are considered patched.

The CVSS score of 6.9 indicates a moderate severity, but the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, implying a low likelihood of current exploitation. Based on the description, it is inferred that the attack vector is a web‑based approach where an attacker can create or edit a blog post to inject scripts, making the public blog interface the likely route for exploitation.