The vulnerability is a stored cross‑site scripting flaw located in the /admin/config-module.php file of the creatorsofcode simplephp application. By submitting a crafted payload through a form that writes configuration data to storage, an attacker can inject arbitrary HTML and JavaScript that are later rendered when a user accesses the admin interface.

The flaw affects the creatorsofcode simplephp project, specifically the repository identified by commit 5184cff, the latest state of the code as of February 27, 2026. No additional product or version ranges are listed; the issue exists in the current release of the application.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, so the exact likelihood of exploitation is uncertain. The CVSS score of 5.4 indicates moderate severity. The likely attack vector requires an attacker to have access to the administration interface or to supply a malicious configuration value that is subsequently displayed to other users. The attack vector is inferred from the description.