The vulnerability in CMS Made Simple allows an attacker to inject malicious scripts through the Message argument in admin/listusers.php of the User Management Module. This cross‑site scripting flaw can execute arbitrary JavaScript in the browsers of users who view the content, enabling cookie theft, session hijacking, site defacement, or the delivery of additional payloads. The flaw is classified as CWE-79.

CMS Made Simple versions up to and including 2.2.21 are affected. The flaw resides in admin/listusers.php and can be triggered by manipulating the Message parameter.

The CVSS score of 4.8 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV and the exploit code is publicly available. Attackers can remotely exploit the flaw by sending a crafted Message parameter to an authenticated or unauthenticated user who views the affected page.