Cross‑site Scripting is present in the index.php file of CuteNews 2.1.2. The flaw allows an attacker to craft a request with an arbitrarily named URL parameter key; part of the key can contain a URL‑encoded XSS payload such as ">\<script>alert(1)</script>. When that key is processed, the encoded payload is reflected in the page response, enabling the execution of arbitrary JavaScript in the victim’s browser. This can lead to session hijacking, defacement, or other client‑side attacks.

The vulnerability affects installations of CuteNews version 2.1.2. No additional vendor or product information is provided beyond the CuteNews application. The issue is located in the index.php component that handles incoming URL query parameters.

The flaw can be exploited remotely by any unauthenticated user who can construct a suitable URL. No authentication or privileged access is required, and the attack can be performed over the network. The EPSS score is not available, but the CVSS score is 6.1, indicating a medium severity vulnerability. The vulnerability is not listed in CISA KEV, but the nature of the vulnerability affords the potential for widespread client‑side exploitation in exposed environments.