Stored cross-site scripting vulnerabilities allow attackers to inject malicious scripts that persist in the system and execute in the browsers of other users who view the affected content. In this case, a manipulated file field within the Form Plugin can store user-supplied code. Attackers could then exfiltrate session data, deface the site, or perform social engineering against administrators or visitors. The weakness corresponds to CWE-79, and the input handling flaw is associated with CWE-434 (unrestricted file upload).

Connect CMS, developed by Open Source Workshop, is directly affected. All versions in the 1.x series up to and including 1.41.0 and the 2.x series up to and including 2.41.0 contain the flaw. Versions 1.41.1 and 2.41.1 contain the fix. The vulnerability is present in the Form Plugin's file field.

The CVSS score of 8.2 indicates a high severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Exploitation would require a user to submit a forged file through the form plugin, after which the malicious script would persist in the database and execute whenever any user processes that file. Because the stored payload is delivered via normal web pages, the attack vector is remote and relies on web access to the CMS.