The vulnerability allows arbitrary client‑side scripts to be injected through the TextHTML plugin in FluentCMS 1.2.3, which can execute in the browser context of any user who views the affected content.

FluentCMS 1.2.3, specifically the TextHTML plugin.

The CVSS score of 6.1 indicates moderate severity. XSS vulnerabilities usually depend on the ability to submit user‑controlled input; here an attacker would need access to the content creation interface. The EPSS score of less than 1% suggests a low probability of exploitation, and the issue is not listed in CISA KEV. The risk remains that scripts could run in the user’s browser, potentially exposing session data or manipulating the page.