GetSimple CMS CE EUVD-2026-91019

Exploitation requires two combined conditions: (1) the attacker must already be an authenticated GetSimple CMS CE user with rights to edit a page (to store the payload in a page's Keywords, Description, Menu text, or Content), and (2) an administrator must subsequently open that specific page's backup in the backup viewer (admin/backup-edit.php), where the stored value is decoded via htmldecode()/strip_decode() and printed without re-escaping. Limiting factors: payload execution is not immediate or attacker-triggered - it depends on an admin voluntarily viewing the affected backup; the attacker needs a valid page-editing account; and impact is confined to the admin control-panel browser context. No fixed version exists, so mitigation currently requires restricting page-editing accounts and caution when viewing backups of untrusted pages.

The provided CVSS 4.0 vector scores 8.8, but this appears inflated and partly inconsistent with the description. The vector lists PR:N (no privileges) and UI:N (no user interaction), yet the description explicitly states this is an AUTHENTICATED stored XSS requiring a user who can edit a page, and execution only occurs when an administrator later views that page's backup - i.e. it genuinely requires both attacker privileges (PR:L) and victim interaction (UI/Active). This PR:N/UI:N vs. description conflict should be verified with the vendor advisory; the realistic score is lower than 8.8. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced, so the exploitation signal is weak: no public exploit identified at time of analysis. The practical risk is a privilege-escalation path - a lower-privileged page editor can hijack an administrator's session/actions in the control panel - which is meaningful in multi-user deployments but constrained by the dual requirement of attacker edit access plus admin viewing the crafted backup. Compounding factor: no patch is currently available, so defenders cannot remediate by upgrading. Net assessment: a real but conditional second-order (stored) XSS, not a drive-by critical; priority is tempered by niche product footprint, authentication requirement, and absence of exploitation evidence.

A low-privileged user with page-editing rights stores a JavaScript payload in a page's Keywords, Description, Menu text, or Content field, which is correctly HTML-encoded on save. When an administrator later opens that page's backup in admin/backup-edit.php, the viewer decodes the stored value (via htmldecode()/strip_decode()) and prints it unescaped, executing the attacker's script in the admin control-panel context. No public exploit code is currently referenced, but the vulnerability class (stored XSS via double-decoding) is straightforward to weaponize for admin session or action hijacking.