Basercms CVE-2026-32734

Victim must be logged into baserCMS versions prior to 5.2.3 and click a malicious link or visit attacker-controlled page that exploits DOM-based XSS in the tag creation feature. Remote unauthenticated attacker crafts the payload; user interaction required.

This vulnerability presents moderate real-world risk with important caveats. The CVSS 7.1 HIGH rating reflects network accessibility (AV:N), low attack complexity (AC:L), no required privileges (PR:N), and scope change (S:C) allowing impact beyond the vulnerable component. However, the required user interaction (UI:R) significantly constrains exploitability-an attacker must convince a victim to interact with a malicious link or crafted input. EPSS probability data was not provided, limiting quantitative risk assessment. No confirmed active exploitation (not present in CISA KEV) and no public exploit identified at time of analysis reduce immediate threat level. The SSVC technical impact is moderate (partial confidentiality/integrity compromise via session hijacking or credential theft). Exploitation is not fully automatable due to the UI:R requirement, necessitating social engineering. Priority should be HIGH for public-facing baserCMS installations where users create tags, MEDIUM for internal instances with limited exposure. The availability of a vendor patch in version 5.2.3 significantly reduces risk for organizations with active patch management.

An attacker crafts a malicious URL or form targeting the baserCMS tag creation interface, embedding JavaScript payload in parameters processed by client-side DOM manipulation code. The attacker sends this link to a baserCMS administrator via phishing email disguised as a legitimate tag management request. When the victim clicks the link while authenticated to their baserCMS instance, the malicious JavaScript executes in their browser with their session privileges, allowing the attacker to steal session cookies, perform unauthorized administrative actions such as creating rogue admin accounts, modify website content, or exfiltrate sensitive data from the CMS. The scope change (S:C) in the CVSS vector indicates the attacker could potentially impact resources beyond the vulnerable tag component, such as the broader website or other users' sessions.