The vulnerability is a stored cross‑site scripting flaw in baserCMS’s custom content description feature. A malicious actor can inject a script that is persisted and later executed in the browsers of users who view the affected content. This client‑side execution can lead to session hijacking, credential theft, or page defacement. The flaw is a stored input injection weakness (CWE‑79) that compromises the application’s integrity and confidentiality.

The flaw exists in all baserCMS installations that expose the custom content description field for user input. No specific version constraints are listed; therefore any deployment using the default content description mechanism could be vulnerable until a patch is applied.

The CVSS score of 5.1 places the issue in the moderate severity range. The EPSS score is less than 1%, indicating a very low exploitation probability, and the vulnerability is not currently enumerated in the CISA KEV catalog, indicating no confirmed widespread exploitation. Likely attack requires authenticated access to the CMS content editing interface or a compromised user account to inject the malicious payload, after which any user who loads the stored content will be affected. The overall risk is considered moderate pending the discovery of a patch or mitigation.