CuteNews v.2.1.2 copies the value of the Referer header into the response HTML without escaping during POST requests to index.php. This allows an attacker to inject arbitrary JavaScript that will run in the browsers of any users who view the affected page. Such injected scripts can hijack session cookies, perform malicious actions on behalf of users, or otherwise compromise the integrity and confidentiality of the site.

CuteNews version 2.1.2 is the affected product. The index.php script processing POST requests is the source of the vulnerability.

An attacker can trigger the flaw by sending a crafted HTTP POST with a malicious Referer header to index.php. The payload is reflected directly into the page, so a user who loads the page will have the script executed. The CVSS score is 5.8, indicating a medium severity. The EPSS score of <1% reflects a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. XSS gives high risk to confidentiality and integrity.