baserCMS EUVD-2026-89663

Exploitation requires an authenticated account with sufficient privilege to create or edit content via the 'custom content' feature (PR:L), specifically the content description field that is stored and rendered unsanitized. Execution also requires victim user interaction (UI:R) - another user must view the malicious content in their browser for the injected script to run. This limits exploitation to attackers who already possess a low-privileged baserCMS editorial account and can lure or wait for a higher-value user (e.g. an administrator) to view the poisoned content; it is not exploitable pre-authentication or against a user who never renders the affected content.

The single available severity signal is a vendor/JVN-sourced CVSS 3.0 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), a medium rating consistent with a typical stored XSS. No EPSS probability, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The vector shows network reach (AV:N) and low complexity (AC:L) but is meaningfully constrained: PR:L means the attacker must already hold a low-privileged authenticated account to inject the payload, and UI:R means a victim must load the affected content for the script to fire. The scope change (S:C) with C:L/I:L reflects that script executes in the victim's browser session against the CMS origin rather than compromising the server directly. This is a real but moderate issue - a genuine stored XSS worth patching, not a critical unauthenticated RCE. Realistic risk is bounded by the authentication requirement and the limited (Low) confidentiality/integrity impact; there is no availability impact. No conflicting signals were detected between the vector and the description; both describe an authenticated, browser-side stored XSS.

An authenticated low-privileged baserCMS content editor injects a malicious script into a custom content description field, which is stored and later rendered without proper sanitization. When an administrator or other user views that content in the CMS, the script executes in their browser session, potentially stealing session cookies or performing actions as the victim. No public proof-of-concept exploit was identified in the provided data.