wCMS v1.4 contains a stored Cross‑Site Scripting vulnerability that is triggered when a new blog entry is created. The flaw allows an attacker to embed arbitrary JavaScript into the blog content, which will execute in the browsers of anyone who views the entry. This can lead to compromise of the visitor’s session, theft of authentication cookies, or execution of further malicious actions on the client side.

The vulnerability is specific to wCMS version 1.4. No other vendors or product versions are currently listed as affected.

The CVSS score is 6.1, indicating medium severity. No EPSS score is available, and the vulnerability is not listed in KEV. The ability to inject client‑side code gives an attacker the potential to deface content, phish users, or propagate malware. The attack vector requires that the malicious blog entry be created, which may be possible only if the user is authenticated and has permission to create blog posts. If an attacker can obtain such privileges, the impact becomes significant for all visitors of the site.