A stored cross‑site scripting flaw was discovered in HAX CMS prior to version 26.0.0. The <video‑player> component fails to sanitize the source attribute, allowing a javascript: URI to be stored. When any user visits the page, the browser executes the malicious script in the victim’s context, giving an attacker the ability to run arbitrary code, steal session tokens, and access confidential data. The vulnerability is classified as CWE‑79 and also involves improper encoding (CWE‑116).

The flaw affects haxtheweb’s HAX CMS (NodeJS backend) and the associated video‑player component in all releases before 26.0.0. Any deployment of these components that uses the <video‑player> tag is vulnerable until the patch is applied.

With a CVSS score of 9.3, the vulnerability is considered high severity. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, but the impact remains significant. Attackers can inject malicious content through the CMS’s content editing feature; the stored payload then propagates to all users who view the affected page. Because the attack vector requires only content injection, knowledgeable attackers can exploit the flaw without additional privileges beyond the ability to post or edit pages.