# CVE-2021-47931: Exponent CMS stored XSS and credential disclosure in text editing endpoint

Source: https://junglewise.ai/threats/cve-2021-47931-exponent-cms-stored-xss-and-credential-disclosure-in-text-editing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-10. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2021-47931 · Severity: medium · CVSS 6.4 · Published 2026-05-10

Exponent CMS, an open-source content management system used for building and managing websites, contains a security flaw that allows logged-in users to inject malicious scripts into the site's content. If an attacker successfully exploits this, they can execute unauthorized code in the browsers of other users, potentially leading to account takeover or data theft. Additionally, the system inadvertently reveals database login credentials and lacks protection against automated password-guessing attacks, further increasing the risk of a full site compromise.

## Quick answers

**Is CVE-2021-47931 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-47931 being exploited in the wild.

**How severe is CVE-2021-47931?** Medium severity, with a CVSS score of 6.4, published 10 May 2026.

**Which products and versions are affected?** Exponent CMS Exponent CMS <= 2.6.

**Is there a fix for CVE-2021-47931?** A patch was published on 2024-12-26: Version 2.7.2 and 3.0.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-47931 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2021-47931?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Exponent CMS 2.6 and earlier versions contain a stored cross-site scripting (XSS) vulnerability within the 'Title' and 'Text Block' parameters of the text editing endpoint. Authenticated attackers can inject malicious iframe payloads containing SVG onload events to execute arbitrary JavaScript in the context of other users' sessions. Furthermore, the application suffers from information disclosure by exposing database credentials (server, username, and database name) in certain responses. The authentication mechanism also lacks brute-force protection, such as rate limiting or account lockout, allowing for automated credential stuffing or password guessing. While version 2.7.2 and 3.0.2 have been released, users are encouraged to upgrade to the latest versions to mitigate these risks.

## Affected products

- Exponent CMS Exponent CMS <= 2.6

## Timeline

- 2021-10-22: other: Vulnerability discovered by researchers
- 2021-12-20: disclosed: Exploit published on Exploit-DB
- 2024-12-26: patched: Version 2.7.2 and 3.0.2 released
- 2026-05-10: advisory: CVE published/updated in NVD

## References

- [https://www.exploit-db.com/exploits/50611](https://www.exploit-db.com/exploits/50611)
- [https://www.exponentcms.org/](https://www.exponentcms.org/)
- [https://www.vulncheck.com/advisories/exponent-cms-multiple-vulnerabilities-stored-xss-authentication](https://www.vulncheck.com/advisories/exponent-cms-multiple-vulnerabilities-stored-xss-authentication)