Editors with the ability to create or modify page content can insert arbitrary HTML into page titles. The CMS stores those titles in the search index without sanitization. When the indexed titles are rendered in search result pages, the embedded markup is output unencoded, allowing attackers to inject malicious scripts that execute in the browsers of site visitors. This vulnerability is a classic stored cross‑site scripting flaw (CWE‑79) and can compromise user confidentiality, integrity, and trust in the site.

The affected software is TYPO3 CMS. Version 13.0.0 through 13.4.30 and 14.0.0 through 14.3.2 are vulnerable. No other vendors or products are noted as impacted.

The CVSS score of 5.1 indicates the flaw is moderately severe, while the EPSS score is not available. The vulnerability is not currently listed in CISA's KEV catalog. Based on the description, it is inferred that the attack vector is web‑based, requiring an editor session to inject malicious markup into page titles. Once stored, the unsanitized titles are rendered on frontend search result pages, allowing arbitrary JavaScript execution for any visitor of those pages.