What is the CVSS score of CVE-2026-32734?

CVE-2026-32734 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Basercms are affected by CVE-2026-32734?

baserCMS versions prior to 5.2.3 contain a DOM-based cross-site scripting vulnerability in tag creation functionality that allows unauthenticated attackers to inject malicious JavaScript.. A patch is available.

How to fix or mitigate CVE-2026-32734?

Within 24 hours: inventory all baserCMS installations and identify versions prior to 5.2.3. Within 7 days: apply vendor-released patch to baserCMS 5.2.3 or later across all instances. Within 30 days: conduct security awareness training for users on phishing risks and validate patch deployment completion with vulnerability rescanning.

Basercms CVE-2026-32734

EUVD-2026-17269 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-31 GitHub_M

GHSA-677c-xv24-crgx

XSS Basercms

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 01:00 euvd

EUVD-2026-17269

Analysis Generated

Mar 31, 2026 - 01:00 vuln.today

CVE Published

Mar 31, 2026 - 00:46 nvd

HIGH 7.1

DescriptionGitHub Advisory

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has DOM-based cross-site scripting in tag creation. This issue has been patched in version 5.2.3.

AnalysisAI

DOM-based cross-site scripting in baserCMS tag creation functionality allows remote attackers to execute malicious JavaScript in victim browsers. Affects all baserCMS versions prior to 5.2.3. The vulnerability requires user interaction (CVSS UI:R) but needs no authentication (PR:N), enabling phishing or social engineering attacks. EPSS data not available; no public exploit identified at time of analysis. Vendor-released patch available in version 5.2.3.

Technical ContextAI

This is a DOM-based XSS vulnerability (CWE-79) affecting the tag creation component of baserCMS, an open-source website development framework for PHP. DOM-based XSS occurs when client-side JavaScript code processes attacker-controlled input and unsafely writes it to the DOM without proper sanitization. Unlike reflected or stored XSS, the malicious payload never reaches the server-the vulnerability exists entirely in client-side code. The affected product is baserproject:basercms (CPE 2.3:a:baserproject:basercms) across all versions in the 5.x branch prior to the patched release. The tag creation interface likely accepts user input that is directly manipulated via JavaScript (e.g., document.write, innerHTML, or DOM manipulation APIs) without encoding special characters, allowing attackers to inject arbitrary HTML/JavaScript that executes in the security context of the application.

RemediationAI

Immediately upgrade to baserCMS version 5.2.3 or later, which contains a complete fix for the DOM-based XSS vulnerability in tag creation. The patched release is available at https://github.com/baserproject/basercms/releases/tag/5.2.3. Organizations should follow standard upgrade procedures including backing up database and files, testing in a staging environment, and verifying tag creation functionality post-upgrade. If immediate patching is not feasible, implement defense-in-depth controls: restrict tag creation permissions to trusted administrative users only, deploy Content Security Policy (CSP) headers with strict script-src directives to mitigate XSS impact, and educate users about not clicking suspicious links related to tag creation workflows. Monitor application logs for unusual tag creation patterns or JavaScript injection attempts. Review any custom tag-handling code for similar DOM manipulation vulnerabilities. Long-term, establish a regular patch cadence for baserCMS and subscribe to security advisories at https://basercms.net/security to receive timely notifications of future vulnerabilities.