ApostropheCMS allows editors to enter color values that are incorporated directly into <style> tags without proper escaping. The @apostrophecms/color‑field module incorrectly accepts values prefixed with '--', bypassing TinyColor validation, and the subsequent laundering process only coerces types, leaving HTML metacharacters intact. When these unsanitized values are concatenated into style elements marked as safe HTML, an attacker can close the style tag and inject JavaScript. This flaw is a typical stored XSS (CWE‑79) that can lead to session hijacking, cookie theft, and, if an administrator views the compromised widget, privilege escalation to full administrative access.

The vulnerability affects ApostropheCMS version 4.28.0 and all earlier releases. The affected product is the open-source Node.js content management system developed by apostrophecms.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score is not provided, implying no data on current exploitation likelihood. The flaw is listed outside the CISA KEV catalog. Exploitation requires access to the CMS editor interface, meaning that a user with content‑editing rights can inject malicious values. Once injected, every visitor to pages containing the affected widget will execute the embedded script, potentially compromising all users’ sessions and escalating to administrative privileges if the admin views the draft content.