The vulnerability is a DOM‑based cross‑site scripting flaw that occurs when a user creates a tag. Improper encoding of user‑supplied data allows an attacker to inject arbitrary JavaScript that runs in the browser of any visitor to the affected page. The resulting compromise can include session hijacking, credential theft, or defacement, as the attacker can execute code with the privileges of the victim user. This weakness is identified as CWE‑79.

The flaw exists in baserCMS versions prior to 5.2.3, including all releases from 5.0.0 up to 5.2.2. The vulnerable component is part of baserproject’s basercms framework, which is deployed on user‑managed web sites.

The CVSS v3.1 score of 7.1 indicates high severity. The EPSS score of less than 1% suggests that the probability of exploitation is currently low, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Based on the description it is inferred that the attack vector is likely remote, originating from the public tag‑creation endpoint where malicious input can be submitted via a web form or API. Attacking therefore requires an attacker to supply the malicious payload, but no authentication is needed if the endpoint is publicly reachable. The resulting damage would be confined to the browsers of users who view the affected tag content.