The vulnerability is a reflected cross‑site scripting flaw in the Navigate CMS. Untrusted data supplied to the "/blog" endpoint is not sanitized before rendering, allowing an attacker to inject JavaScript that will run in a victim’s browser. This can lead to session hijacking, credential theft, or defacement of the displayed page.

The flaw exists in Navigate CMS versions prior to 2.9.6. The vendor’s fix is shipped in version 2.9.6 and later. Administrators should verify that their installations are not running a vulnerable release.

The CVSS score of 5.1 indicates moderate risk, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote: an attacker can craft a malicious URL to the "/blog" endpoint that a victim clicks on or is otherwise prompted to visit. No special privileges are required on the server side, making it broadly accessible to remote users.