Which versions of PHP are affected by CVE-2026-4225?

CVE-2026-4225 is a low-severity vulnerability in CMS Made Simple involving cross-site scripting (CVSS 2.4).

Is there a public PoC exploit available for CVE-2026-4225?

Yes, a public proof-of-concept exploit is available for CVE-2026-4225. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4225?

During next maintenance window: Apply vendor patches when convenient. Verify cross-site scripting controls are in place.

PHP CVE-2026-4225

Q: What is the CVSS score of CVE-2026-4225?

CVE-2026-4225 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12366 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-03-16 VulDB

PHP XSS N A Cms Made Simple

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.8 (MEDIUM) 1.9 (LOW)

Severity Changed

Apr 22, 2026 - 21:37 NVD

LOW MEDIUM

CVSS changed

Apr 22, 2026 - 21:37 NVD

2.4 (LOW) 4.8 (MEDIUM)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 16, 2026 - 09:00 euvd

EUVD-2026-12366

Analysis Generated

Mar 16, 2026 - 09:00 vuln.today

CVE Published

Mar 16, 2026 - 07:32 nvd

LOW 2.4

DescriptionCVE.org

A security flaw has been discovered in CMS Made Simple up to 2.2.21. Impacted is an unknown function of the file admin/listusers.php of the component User Management Module. Performing a manipulation of the argument Message results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

A cross-site scripting (XSS) vulnerability exists in CMS Made Simple versions up to 2.2.21 affecting the User Management Module's admin/listusers.php file. An attacker with high-level privileges can inject malicious JavaScript through the Message parameter to compromise other users' sessions or steal sensitive data. Public exploit code is available and the vulnerability has been actively exploited, making this a tangible threat despite its low CVSS score of 2.4.

Technical ContextAI

CMS Made Simple is a PHP-based content management system vulnerable to reflected cross-site scripting (CWE-79) in its administrative user management interface. The vulnerability occurs in the admin/listusers.php component where user-supplied input in the Message parameter is not properly sanitized or escaped before being rendered in HTML context. CMS Made Simple versions prior to 2.2.22 fail to implement adequate output encoding for message parameters, allowing attackers to inject arbitrary HTML and JavaScript that executes in the context of authenticated administrator sessions. The root cause is improper handling of untrusted user input at the presentation layer without sufficient HTML entity encoding or content security policy implementation.

RemediationAI

Immediately upgrade CMS Made Simple to version 2.2.22 or later, which contains patches addressing the XSS vulnerability in the Message parameter processing. The vendor advisory should be consulted for exact upgrade procedures and any version-specific compatibility considerations. As an interim mitigation pending patching, implement strict administrative access controls limiting admin/listusers.php access to specific IP ranges, enforce strong session management with short timeout periods for administrator accounts, deploy Web Application Firewalls (WAF) with XSS detection rules to filter suspicious Message parameter values, and consider implementing Content Security Policy (CSP) headers to restrict script execution. Monitor administrator session logs for unusual activity that may indicate exploitation attempts.