Statamic CMS allows an attacker to inject arbitrary JavaScript by exploiting an unescaped redirect parameter in the user:reset_password_form tag. This reflected XSS flaw can execute malicious code in the victim’s browser when the reset password form is accessed. The weakness is classified under CWE‑79, indicating insufficient output encoding.

Statamic CMS, versions before 5.73.16 and 6.7.2, is affected. Administrators should verify that their installations run one of these unpatched releases.

The CVSS score of 6.1 indicates medium severity, while an EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. It is inferred that an attacker only needs to compose a malicious URL containing the unescaped redirect parameter and persuade users to click it; no authentication is required. The vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation.