Executive brief
FluentCMS, a content management system, contains a security flaw in its TextHTML plugin. This vulnerability allows an attacker to inject malicious scripts into web pages. If a user views a compromised page, the attacker could steal login session information or perform unauthorized actions on the user's behalf.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in FluentCMS 1.2.3 within the TextHTML plugin, specifically affecting the /pagepreview functionality. The root cause is improper neutralization of user-supplied input before it is rendered in the HTTP response (CWE-79). An attacker can exploit this by accessing the page preview mode, selecting the TextHTML plugin, and injecting a malicious payload via the edit menu. The attack requires a user to interact with the crafted content (UI:R) but does not require prior authentication (PR:N). Successful exploitation allows for arbitrary JavaScript execution in the context of the victim's browser session.
Affected products
- FluentCMS FluentCMS 1.2.3
Timeline
- 2026-03-02: disclosed: Issue reported on GitHub repository
- 2026-05-05: advisory: CVE published to NVD