A cross‑site scripting flaw resides in the store function of the Extended Management Module of Yifang CMS, specifically in the file plugins/yifang_backend_account/logic/admin/L_rbac_admin.php. By manipulating the Account argument, an attacker can inject arbitrary JavaScript that will be executed in the browsers of users who view the affected page. The injected code may steal session cookies, deface the site, or perform other malicious actions. The flaw is executable remotely, and the corresponding exploit has already been released publicly.

Versions of Yifang CMS up to and including 2.0.5 are affected. No higher‑version data is provided, and the vendor has not responded to the disclosure. The vulnerability resides in the Extended Management Module supplied by Yifang:CMS.

The CVSS score of 5.1 places this issue in the medium severity range. EPSS and KEV data are not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as the description specifies that the exploitation can be performed from outside the system. An attacker only needs to send a crafted request containing the malicious Account parameter to trigger the XSS payload. Once the script runs in a victim’s browser, confidentiality, integrity, and availability of user accounts on the affected site can be compromised.