A cross‑site scripting vulnerability exists in gougucms version 4.08.18 within the Record Endpoint at record.html. An attacker can inject malicious script by manipulating the value.content argument. The flaw is exploitable remotely and a public exploit demonstrates its use. Successful exploitation allows arbitrary script execution in the victim's browser, enabling session hijacking, data theft, or malicious actions performed under the victim's authority. The impact is confined to client‑side code execution and does not directly compromise the server or its data.

The flaw affects the gougucms content management system, specifically version 4.08.18, and the Record Endpoint module. No other vendors or product variations were listed, and the issue is limited to this version of gougucms.

With a CVSS base score of 5.1, the vulnerability carries a moderate severity. EPSS information is unavailable, and it is not included in the CISA KEV catalog. The publicly available proof‑of‑concept shows that the exploit can be launched remotely by sending a crafted request to the value.content parameter. Because the attack requires only client interaction with the vulnerable page, the risk is high for users who visit the affected endpoint. The lack of an official vendor patch places the burden of mitigation on site administrators.