A reflected cross‑site scripting vulnerability exists in the EntryAbstract.save component of the APSL Puput CMS. When an authenticated user with Wagtail Editor privileges submits a crafted payload, the input is returned directly in the browser, allowing the attacker to execute arbitrary JavaScript in the victim's context. This can lead to session hijacking, credential theft, or other actions that compromise the confidentiality and integrity of the user's session.

The flaw affects installations of the APSL Puput CMS from version 1.2.1 up to and including 2.2.0. It is triggered when users possessing Wagtail Editor rights invoke the EntryAbstract.save operation. No other vendors or products are reported as affected, limiting the impact to environments running these versions of APSL Puput with editor access.

Because the vulnerability requires authentication and editor‑level privileges, it is not exploitable by anonymous users; however, insiders or compromised editor accounts can abuse the flaw. The mechanism is a typical reflected XSS, allowing an attacker to embed a malicious script within a request that is rendered by the browser. With a CVSS score of 6.1, the vulnerability is considered medium severity, and the EPSS score is < 1 %. It is not listed in CISA KEV, but the lack of public exploitation does not diminish the potential risk to organizations that rely on APSL Puput. The risk is assessed as high for any site that allows editor access to untrusted users.