The vulnerability is a stored cross‑site scripting flaw located in the Theme to Components feature of GetSimple CMS CE. A malicious title value is saved to the database and later rendered inside a double‑quoted HTML attribute without proper re‑encoding, allowing an attacker to inject and execute arbitrary JavaScript in the administrative panel.

GetSimple CMS Community Edition versions 3.3.22 and earlier are affected. The flaw resides in admin/components.php, where the title parameter of the Theme to Components functionality is vulnerable. Only installations running those legacy versions and that expose this feature are at risk.

The CVSS score of 8.7 indicates high severity, but no EPSS information is available, so the likelihood of exploitation cannot be precisely quantified. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires the attacker to submit a crafted title string through the Theme to Components form; the payload will then persist and execute whenever the administrative interface loads the stored value. Because the code runs in the admin context, any user who can view the admin panel will be affected.