The flaw resides in YiFang CMS 2.0.5, inside the D_friendLink.php update function. By manipulating the linkName argument, an attacker can inject malicious JavaScript that is rendered in a visitor's browser. This cross‑site scripting capability enables session hijacking, credential theft, or defacement when the affected link is viewed.

YiFang CMS version 2.0.5 is affected. No earlier or later versions are referenced; the CPE indicates this specific release.

The CVSS score of 5.1 classifies the vulnerability as moderate severity, and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The issue is publicly disclosed and can be triggered from any remote location without special permissions, yet it does not provide a path to full system compromise; it only affects the integrity and confidentiality of the victim's browser session. The vulnerability is not listed in the CISA KEV catalog.