A stored cross‑site scripting flaw exists in the REDAXO media manager. The mediaIsInUse() handler writes the media type name directly into backend warning HTML without escaping. An administrator with Media Manager permissions can create a type whose name contains arbitrary HTML. When another administrator later attempts to delete media that uses this type, the stored payload executes in the administrator’s browser, enabling session hijacking or unauthorized backend actions. This is a classic input validation weakness (CWE‑79).

The vulnerability impacts REDAXO core versions prior to 5.21.2. All releases up to 5.21.1 are affected; the fix is included in release 5.21.2 and later.

The CVSS score of 4.8 rates this flaw as moderate severity. Exploitation requires an authenticated administrator with Media Manager access; public exploitation is unlikely. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, indicating a lower exploitation probability in the wild. Nonetheless the potential for session theft warrants patching as soon as an update is available.