A cross‑site scripting (XSS) flaw exists in the Administrator Backend of QianFox FoxCMS within the /Tag/edit endpoint. When a specially crafted input is submitted to this component, the application renders the payload without proper escaping, allowing arbitrary JavaScript to execute in the browser context of anyone who views the affected page. This vulnerability enables the execution of client‑side scripts but does not grant direct code execution on the server or compromise operating system. The weakness is categorized as CWE‑79 (Unvalidated or incorrectly validated input) and CWE‑94 (Improper Parsing of Input).

The vulnerability affects QianFox FoxCMS versions up to and including 1.2.6. Any installation that includes the Editor module at /Tag/edit for the Administrator Backend is potentially vulnerable. No public patch has been released and the vendor has not yet responded to the issue report.

Based on the description, it is inferred that the attack can be launched remotely by submitting the malicious input, and no specific authentication or administrative privileges are mentioned, implying that any user who can reach the /Tag/edit endpoint could attempt exploitation. The CVSS score of 4.8 indicates moderate severity, while the EPSS score is not available, so the probability of exploitation cannot be quantified from the data provided. The vulnerability is not listed in the CISA KEV catalog, and no confirmed public exploits are cited in the references.