Typemill CMS version 2.x has a persistent cross‑site scripting flaw in its Markdown parser extensions, which allows an authenticated user with theme‑configuration privileges to store malicious JavaScript URIs in Markdown links. The flaw is introduced when unsanitized href values are accepted by ParsedownExtension.php or TwigMarkdownExtension.php, and the malicious payload is rendered for any browser that clicks the link. This behavior enables session cookie theft, authenticated request forgery, and credential harvesting – all of which compromise confidentiality and integrity for end users.

The vulnerability affects all installations of Typemill CMS 2.x. No specific sub‑versions are listed as unaffected, so any 2.x release is considered at risk until patched. Vendors have noted the issue in the 2.23.0 release notes, implying that earlier releases are vulnerable.

The CVSS score of 4.6 places this flaw in the medium severity range. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of large‑scale exploitation remains low at present. Attackers must first possess valid login credentials with theme‑configuration rights, after which they can inject a persistent link that triggers JavaScript execution in any visitor's browser. While there is no remote code execution vector, the injected script runs with the privileges of the page visitor, enabling credential theft and session hijacking.