The flaw is a reflected XSS vulnerability found in the STL processing endpoint of SSCMS v7.4.0. Malicious STL templates are decrypted and inserted into JSON responses without proper sanitization, allowing an attacker to inject executable JavaScript. This can compromise user sessions, perform phishing attacks, or trigger actions on behalf of authenticated users. The weakness is of type CWE‑79, representing untrusted input rendered without encoding.

The affected product is Siteserver SSCMS version 7.4.0, which is used to publish the /api/stl/actions/dynamic endpoint that processes STL payloads.

The CVSS score is 2.1, indicating low severity. The EPSS score is not available, so the likelihood of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog. Attackers would need access to the vulnerable endpoint to craft a malicious STL payload, suggesting that restricting endpoint exposure reduces attack feasibility.