InstantCMS 2 CVE-2026-108566

Requires an authenticated low-privilege icms2 account (CVSS PR:L) to control a user nickname that is used in the Private Message Handler. The nickname is emitted unescaped into the title attribute of a contact anchor in templates/default/controllers/messages/index.tpl.php (and the modern template), so exploitation requires the attacker to appear as a contact in the victim's private-message list and requires the victim to load that contact list (UI:P). Limiting factors: a valid account is mandatory, victim interaction (viewing the messages page) is required, and the issue is confined to the message contact-list rendering in affected template versions up to 2.18.2.

This is a moderate, not urgent, issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) and the resulting 5.1 score indicate a network-reachable but privilege- and interaction-gated flaw: PR:L confirms the attacker must hold a valid (low-privilege) icms2 account, and UI:P means a victim must view the affected page for the stored payload to fire. Impact is limited to VI:L with no confidentiality or availability impact in the supplied vector, consistent with a stored XSS in a private-message contact list rather than a system-compromising bug. Exploitation signal: the CVSS 4.0 exploit-maturity metric is E:P and the description states the exploit was publicly disclosed, so publicly available exploit code exists - but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The POC existence raises likelihood of opportunistic abuse but should not be conflated with in-the-wild activity. Net: a real but low-to-moderate priority issue, appropriate to patch on a normal maintenance cycle rather than emergency timelines, especially given the niche deployment footprint of the product.

An attacker registers or uses a low-privilege account and sets their user nickname to a string containing a script payload, then initiates private-message contact with a target user. When the victim opens their private messages contact list, the nickname is rendered unescaped inside an HTML title attribute, executing the attacker's script in the victim's browser session. A public proof-of-concept has been disclosed (CVSS E:P), lowering the effort needed to reproduce it.