The vulnerability resides in Easy Blog Site version 1.0, specifically in the /posts/update.php script that processes the postTitle field. An attacker can supply malicious JavaScript in the postTitle value, which the application stores and later renders without proper encoding, enabling a stored cross‑site scripting attack. The main consequences are the takeover of user sessions, site defacement, or distribution of malware to visitors. The weakness corresponds to input validation failures (CWE‑79) and code injection possibilities (CWE‑94).

All installations of code‑projects Easy Blog Site version 1.0 that include the /posts/update.php routine are affected, as the uncovered flaw involves the postTitle parameter in that script. No other versions or sub‑versions were specifically identified in the advisory.

The flaw carries a CVSS base score of 5.1, placing it in the medium severity range. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no large‑scale exploitation reports yet. However, the description indicates the exploit is available over the Internet and can be triggered remotely by delivering a crafted postTitle payload that is subsequently rendered in the browser. Because the stolen input is stored, any user who views the compromised post will be affected, raising the potential impact for confidentiality, integrity, and availability.