Stored cross‑site scripting (XSS) exists in HAX CMS and its associated components before version 26.0.0 because <iframe> elements are not properly sanitized and allow javascript: URIs to be inserted into the src attribute. When a victim loads a page containing such an iframe, the browser executes the injected JavaScript in the victim’s context. This lets an attacker read client‑side data, hijack the user’s session, and perform an account takeover.

HAX CMS (NodeJS backend), Iframe Loader and Video Player products from haxtheweb are affected. All releases before 26.0.0 are vulnerable. Version 26.0.0 and later contain the fix.

The CVSS score of 9.3 indicates a critical severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must first inject a malicious iframe via a page that the CMS stores; when a user opens that page, the injected JavaScript is executed. The vector is that the CMS permits arbitrary iframe content from users with write access, which can be leveraged by an attacker with that level of access. The impact is execution of code in the user’s browser, allowing data exfiltration and session hijack.