The vulnerability arises when plugin rendering fails in edit mode. The CMS passes attacker‑controlled data—including get_short_description(), the exception message, the placeholder, or the placeholder source—to the exception heading. Because the heading is inserted via mark_safe without escaping, stored HTML can execute in the editor’s browser, providing stored XSS under CWE‑79. An attacker can insert arbitrary script that will run whenever a user opens the editor, potentially capturing credentials or modifying the editing UI.

Affecting the django‑cms framework, version 5.0.8 is vulnerable. The issue was fixed in 5.0.9; any deployments using 5.0.8 or earlier without the patch are at risk.

The CVSS score is 4.4, describing a medium‑severity flaw with limited impact, because the injection is only available when a plugin fails while a user is in edit mode. EPSS data is not available, so exploitation probability is uncertain, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated user with edit permissions, who supplies malicious content to trigger the exception and inject code. Once executed, scripts run in the context of the editing interface, allowing the attacker to interact with the user’s session.