Connect‑CMS suffers from a DOM‑based Cross‑Site Scripting vulnerability in the Cabinet Plugin list view, affecting versions 1.35.0 through 1.41.0 and 2.35.0 through 2.41.0. The flaw allows an attacker to inject and execute malicious JavaScript when a user accesses the list view, potentially leading to session hijacking, defacement, or the injection of further malware into the authenticated user's browser session.

The vulnerability impacts the OpenSource‑Workshop Connect‑CMS product. All installations running the affected editions – 1.35.0 to 1.41.0 or 2.35.0 to 2.41.0 – are susceptible. Versions 1.41.1 and 2.41.1 contain the fix.

The CVSS score of 8.7 categorizes this issue as high severity, and the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers can likely exploit it by navigating to the cabinet plugin list view in a web browser and injecting script payloads that are reflected into the DOM; no authentication requirement was specified in the release notes, so the ease of attack is uncertain but the potential impact remains significant for any affected user. Prompt remediation is therefore recommended.