Statamic CMS, built on Laravel, is vulnerable to a stored cross‑site scripting (XSS) flaw in the control panel color mode preference. Authenticated users with control panel access can store malicious JavaScript that is executed when a higher‑privileged user impersonates the compromised account. This allows the attacker to run arbitrary code in the context of the impersonator, effectively elevating privileges. The weakness corresponds to CWE‑79 (Improper Neutralization of Input During Web Page Generation).

All Statamic CMS installations running any version prior to 6.6.2 are affected. The vulnerability is specific to the control panel color mode setting feature and is resolved in version 6.6.2 and later.

The CVSS v3.1 score is 5.4, indicating moderate severity, while the EPSS score is below 1%, suggesting low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated user with control panel access to inject the payload, and the attack vector relies on the impersonation capability of higher‑privileged users. Given these conditions, the risk is moderate but exploit probability remains low.