A cross‑site scripting (XSS) vulnerability has been discovered in the Light0011 CMS, specifically within the htmlspecialchars_decode function used in the Chapter Content Output component. The flaw allows an attacker to inject malicious content that is decoded and rendered by the template oneChapter.tpl, leading to the execution of arbitrary JavaScript within the context of a victim’s browser. This can compromise confidentiality, integrity, or availability of user data and can be leveraged for phishing or session hijacking. The weakness aligns with CWE‑79 (Cross‑Site Scripting) and CWE‑94 (Improper Handling of Bytecode or Source Code). The description states that remote exploitation is possible and that the exploit is public.

The vulnerability affects the Light0011 CMS platform. No specific version numbers are provided, as the project follows a rolling‑release model and the responsible commit is referenced only by a hash. Users must verify whether their installed copy of the CMS contains any of the affected files or commits and should proactively update if a fix has been issued.

The CVSS score is 5.3, indicating a moderate severity. No EPSS score is available, so the likelihood of exploitation cannot be quantified, but the public nature of the exploit and the lack of a patch suggest that attacks are plausible. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote; an attacker must supply crafted content that is processed by the decoded function. Based on the description, it is inferred that the attacker can trigger the vulnerability by injecting malicious markup into the content field that the CMS later renders via the oneChapter.tpl template.