Cms Made Simple CVE-2026-4225

While the CVSS v3.1 score of 2.4 appears extremely low, the actual risk profile is notably higher when examining supporting indicators. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C) reveals that exploitation requires high privileges and user interaction, which correctly bounds the severity. However, the presence of public exploit code (E:P), confirmed proof-of-concept availability, and active exploitation in the wild significantly elevate practical risk. Under SSVC decision frameworks, this vulnerability transitions from low-severity due to the high-privilege requirement to a medium-priority remediation due to the exploitability status being proven/unmitigated. Organizations running affected versions should prioritize patching administrator accounts and enforcing strict administrative access controls, as compromised admin sessions can lead to complete site takeover regardless of the limited direct impact of XSS. The discrepancy between CVSS and real-world risk stems from CVSS's limitation in modeling privilege escalation chains and session hijacking consequences.

An attacker with low-level administrative or moderator privileges could craft a malicious URL containing JavaScript payload in the Message parameter of admin/listusers.php and socially engineer a higher-privileged administrator into clicking it. When the administrator visits the page, the unescaped JavaScript executes in their browser session, allowing the attacker to steal session tokens, modify user accounts, or perform administrative actions on behalf of the compromised administrator. Given the low CVSS complexity (AC:L), no additional complexity is required beyond clicking a link, making this a practical attack vector in environments with delegated administrative responsibilities.