GetSimple CMS CE CVE-2026-71542

Exploitation requires the ability to submit/store a component title through the administrative 'Theme to Components' functionality in admin/components.php; the malicious title is stored, then on output HTML-entity-decoded and printed inside a double-quoted HTML attribute without re-encoding, allowing attribute-breakout and script execution. Triggering requires an administrator (or admin-panel user) to subsequently render the affected admin page in their authenticated browser session - so a victim with admin-panel access must view the stored value. Limiting factors: the injection point is an admin feature (requiring at least some authenticated access to write the payload, despite the input vector's PR:N), execution is confined to the admin UI browser context rather than the server, and no official patch exists so mitigation relies on access restriction and input/output sanitization.

Signals are moderate and somewhat conflicting. The supplied CVSS 4.0 vector scores 8.7 (High) driven entirely by VI:H with AV:N/AC:L/PR:N/UI:N, implying remote, unauthenticated, no-interaction exploitation. However, the vulnerability lives in an administrative feature (admin/components.php, 'Theme to Components'), which realistically means an actor must be able to reach and write to that admin function to plant the stored payload, and an administrator must subsequently view it - so the PR:N/UI:N in the input vector likely overstates true exposure and should be verified against GetSimple CMS-CE's role/auth model. No EPSS score is provided. SSVC reports Exploitation=poc (so proof-of-concept exists), Automatable=no, and Technical Impact=partial, which is consistent with a stored XSS that compromises the admin UI session rather than the host directly. It is NOT CISA KEV listed and there is no evidence of active exploitation. Net: this is a genuine stored-XSS weakness in the admin plane worth patching, but the raw 8.7/PR:N framing over-weights it versus the operational reality that it is an admin-context XSS requiring write access to an admin feature and no patch currently exists, so compensating controls are needed in the interim.

A user with access to the 'Theme to Components' admin function submits a component whose title contains a crafted JavaScript payload; because the stored title is HTML-entity-decoded and echoed into a double-quoted HTML attribute without re-encoding, the script becomes persistent. When an administrator later opens the affected admin page, the payload executes in their authenticated session, enabling actions such as session/cookie theft, CSRF-token exfiltration, or creation of a rogue admin account. Proof-of-concept exploitation is indicated by the SSVC 'poc' status, though no weaponized or in-the-wild use is confirmed.