This vulnerability is a stored cross‑site scripting flaw arising from appending unescaped user‑provided strings to email form fields in baserCMS. A malicious actor who can submit a specially crafted email will have the JavaScript stored and later rendered to other site users in their web browsers, allowing arbitrary client‑side code execution. Such execution could compromise credentials, hijack sessions, or facilitate additional attacks that run with the victim’s browser context.

The flaw affects the baserCMS platform distributed by the User Community:baserCMS. All installations that expose the email form feature are potentially vulnerable unless the issue is patched; no explicit version range is listed in the advisory.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score of <1% reflects a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly documented exploitation yet. Attackers would need to supply a malicious email through the form, have it stored, and rely on a victim viewing that content. When a user accesses the page containing the stored entry, the injected script executes in the victim’s browser, granting the attacker the privileges of that end user, while the threat is confined to users who view the affected content.