Microweber CMS 2.0.20 and earlier contain a stored cross‑site scripting flaw in the content tagging system. Admin‑authenticated attackers can inject arbitrary JavaScript by submitting malicious payloads through the tag_names parameter of the GET /api/save_content_admin endpoint, bypassing multiple sanitization controls including XSS middleware that ignores GET requests, a strip_unsafe() function that only removes double‑quoted onerror attributes, and a titlecase normalizer that leaves decimal‑entity encoded HTML unchanged. Stored scripts execute automatically for every visitor to public pages and within the admin editor, enabling session riding through same‑origin fetch requests that contain the CSRF token embedded in the page.

Microweber CMS, version 2.0.20 and earlier. The issue is tied to the content tagging system and applies to configurations that allow administrative users to modify content tags.

The CVSS score of 4.8 indicates moderate severity, with an EPSS score of less than 1% and the vulnerability not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack requires authenticated admin access and can affect all site visitors through stored scripts. Exploitation chances depend on the presence of privileged administrative credentials and the lack of proper input filtering, making it a realistic threat in environments where administrators have broad permissions and content tagging is frequently used.