MCMS version 6.1.1 through 6.2.1 contains a stored Cross‑Site Scripting flaw. The article content field named contentDetails is not passed through the global XSS filter, allowing an attacker to inject malicious script that will execute when other users view the article. This vulnerability can lead to session hijacking, defacement, or the delivery of malware to site visitors.

The flaw exists in the MCMS content management system, specifically versions 6.1.1 through 6.2.1.

The CVSS score of 8.7 and an EPSS score of <1% are reported, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves inserting malicious code while creating or editing an article that contains the contentDetails field; any authenticated user with article‑creation privileges could exploit the flaw. Given the stored nature of the XSS, the impact on confidentiality, integrity, and availability could be significant for all site visitors if exploited.