MCMS CVE-2026-88415

Requires an authenticated account with permission to author/submit article content in MCMS 6.1.1 through 6.2.1 (PR:L), because the payload is injected into the article contentDetails body field, which is specifically excluded from MCMS's global XSS filter. Exploitation is limited by required user interaction (UI:R): a victim - typically an administrator, editor, or site visitor - must view the stored article for the script to execute. It is therefore not remote-unauthenticated and not automatable at scale; it depends on the affected version range and on a privileged/target user rendering the malicious content.

Signals are mixed and point to a moderate, not top-tier, priority. The CVSS 3.1 base score of 8.7 is driven by aggressive impact metrics (C:H/I:H, S:C) that are debatable for a stored XSS in an article field - most authenticated content-injection XSS realistically yields C:L/I:L unless a working session-hijack-to-admin chain is demonstrated, which is not shown here. Exploitation status is 'publicly available exploit code exists' (a GitHub issue POC is referenced and SSVC lists Exploitation: poc); this is NOT active exploitation - there is no CISA KEV listing. EPSS is very low at 0.19% (9th percentile), and SSVC marks Automatable: no, both consistent with a stored XSS that requires an authenticated author to plant a payload and a victim (typically an admin/editor) to view the content - i.e., targeted rather than mass-exploitable. SSVC Technical Impact: total is optimistic and conflicts with the interaction-gated, victim-dependent nature of the flaw. Net: a legitimate bug worth patching, but the 8.7 overstates real-world urgency given PR:L, UI:R, low EPSS, no KEV, and disputable C:H/I:H.

An attacker with a low-privileged authoring account submits an article whose contentDetails body field contains a malicious <script> payload, which bypasses MCMS's global XSS filter because that field is explicitly excluded. When an administrator or other user later views the article in the CMS backend or on the site, the script executes in their session, enabling session/cookie theft or actions in their context. A public POC is referenced on GitHub (issue #2), lowering the effort to reproduce.