The vulnerability is a cross‑site scripting (XSS) flaw within the Add Banner Ads feature of Juzaweb CMS version 5.0.0. An attacker can embed a malicious script in the banner field that is executed in the browser of anyone who views the banner. This enables the attacker to run arbitrary JavaScript, potentially hijacking user sessions, extracting credentials, or defacing the site. The flaw allows execution of arbitrary code, implying the content is stored and later rendered. Based on the description, it is inferred that the XSS is stored in the banner text and triggered when the banner is loaded by a user.

Juzaweb CMS 5.0.0 is the only documented version affected by this issue. The vulnerability resides in the core Add Banner Ads module. No other vendors or product variants are listed. Systems operating this exact version without applying a fix remain exposed.

The CVSS score of 5.4 indicates a moderate severity. EPSS is not available, and the flaw is not listed in the CISA KEV catalog, suggesting no publicly disclosed exploitation. Nevertheless, XSS payloads are typically easy to craft, and the attack requires a banner to be viewed by a target user or administrator. Should exploitation succeed, the attacker could execute malicious JavaScript in the victim’s browser, leading to defacement, credential theft, or further compromise of the CMS environment.