HAX CMS allows an authenticated user with edit permissions to inject JavaScript into stored content via the /system/api/saveNode endpoint by using an event handler attribute without preceding whitespace, which bypasses the HTML sanitizer and results in a stored cross‑site scripting vulnerability; the injected script runs in the browser context of anyone viewing the affected page, potentially enabling session hijacking, credential theft, or defacement.

Affected products include haxtheweb haxcms-nodejs up to version 26.0.0 and haxtheweb haxcms-php up to and including 26.0.0. Patches are available in v26.0.1 for the Node.js backend and v26.0.2 for the PHP backend.

A CVSS score of 8.7 indicates high severity. The exploit requires authenticated access with edit privileges, so the attack vector is likely local/insider. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Because the vulnerability can be leveraged by any user with editing rights, the risk remains significant until affected versions are upgraded.