QuickCMS contains an XSS flaw in its HTTP‑based plugin‑fetching mechanism. A remote attacker can impersonate the official opensolution.org server and serve malicious HTML or JavaScript at the plugin list endpoint. When a legitimate user visits the plugin page, the attacker’s payload is automatically fetched, rendered and executed in the user’s browser, potentially allowing the attacker to steal session cookies, alter page content or perform further client‑side attacks.

The vulnerability affects deployments of OpenSolution QuickCMS that have not applied the patch for version 6.8 released on 15.05.2026. All earlier or unpatched releases are susceptible.

The CVSS score is 2.3, indicating low severity. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires network connectivity and a victim who accesses the plugin page, making the attack vector likely a Man‑in‑the‑Middle scenario on the traffic between a user’s browser and the plugin server. The risk is confined to client‑side impact such as XSS but can be leveraged for phishing or credential theft.