Silverstripe CMS page titles are inserted directly into the breadcrumb trail of the page list view without escaping, creating a classic script injection weakness. An attacker can craft a page title containing JavaScript, which will execute in the browser of any user viewing the list, potentially stealing cookies, credentials, or performing malicious actions. The vulnerability is a standard client‑side XSS flaw designated as CWE‑79 and carries a CVSS score of 5.4, indicating moderate severity.

All installations of Silverstripe CMS before version 6.2.1 are affected. The vulnerability exists in the page list view of the CMS back‑end and applies to any system that has not applied the 6.2.1 release.

The CVSS score of 5.4 signals a moderate risk, and the EPSS score for this exploit is currently not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires access to the CMS page list view, typically available to authenticated content managers; the attacker must ensure a page title contains the malicious payload. Once the vulnerable page is rendered, the script runs in the context of the administrator’s browser.