W CMS EUVD-2026-92044

Two concrete injection paths exist: (1) an unauthenticated attacker triggers a failed login whose username field is stored and rendered unescaped in the adminlog.php log viewer; (2) a site visitor submits a comment whose website URL is echoed unescaped into an href attribute in editrightbar.php. The critical limiting factor is that payload execution requires a privileged victim (CVSS UI:P) - specifically an administrator viewing the failed-login log, or an administrator/editor viewing the comment panel - so the script runs only in that privileged user's session and only when they visit the affected admin page. No authentication is required of the attacker (PR:N), and default configurations of wcms expose the login and comment inputs, but impact is bounded to the browser context of whichever admin or editor renders the stored data.

This is a stored XSS (CWE-79) in the niche open-source flat-file CMS 'W' (wcms) through 3.18.0, reported by VulnCheck. The only severity signal provided is a CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) - medium severity. The attacker is unauthenticated (PR:N) and the vector is network (AV:N), which raises exposure, but exploitation is gated by passive user interaction (UI:P): a privileged user - an administrator or editor - must view the adminlog.php log viewer or the editrightbar.php comment panel for the injected script to fire. No EPSS score, CISA KEV listing, or public POC is present in the supplied intelligence, so there is no evidence of active exploitation or weaponization. SSVC-style reasoning: exploitation status is 'none' (no public exploit identified), technical impact is partial (low confidentiality/integrity, no availability), and it is not trivially automatable since it depends on a human victim with elevated privileges visiting the rendered page. The input is internally consistent - CVSS 4.0 vector, description, and CWE all agree on a low-impact, interaction-dependent stored XSS - so no signals conflict. Net: a legitimate issue worth patching, but a medium-priority, interaction-gated flaw in a low-footprint product rather than an urgent mass-exploitation threat. Note only a CVSS 4.0 vector was provided; no CVSS 3.1 vector was supplied for direct comparison.

An unauthenticated attacker submits a failed login using a username containing a crafted script payload (or posts a site visitor comment whose website URL carries a javascript/attribute-breaking payload). The payload is stored unescaped and later rendered when an administrator opens the adminlog.php failed-login viewer or an editor views the comment URL in editrightbar.php, executing attacker-controlled script in that privileged user's browser session. No public exploit code was identified at the time of analysis, though the vulnerable sink lines are pinpointed in the referenced GitHub source.