ApostropheCMS versions 4.28.0 and earlier allow an authenticated user to store arbitrary characters in SEO Title and Meta Description fields. Because the framework renders these fields without proper escaping, injected payloads can break out of the intended HTML context and execute JavaScript in the browsers of any authenticated user who visits the affected page. The injected script can then perform authenticated API requests, retrieving sensitive data such as usernames, email addresses, and roles, and exfiltrate that data to an external server.

All installations of ApostropheCMS version 4.28.0 or older. The vulnerability was fixed in 4.29.0.

The CVSS score is 8.7, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Being an XSS flaw that requires an authenticated session, the most likely attack path is an attacker who has gained legitimate credentials or compromised a user account exploiting the CMS page rendered for that user. Successful exploitation would give the attacker the same level of access as the victim, allowing data theft and potential privilege escalation within the application.