Is CVE-2026-93460 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93460 being exploited in the wild.

How severe is CVE-2026-93460?

Medium severity, with a CVSS score of 5.4, published 30 September 2026.

Which products and versions are affected?

baserCMS User Community baserCMS 5.0.0 through 5.4.0.

Is there a fix for CVE-2026-93460?

A patch was published on 2026-09-24: Fix available in baserCMS 5.3.1 and 5.4.1 or later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-93460 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-93460?

Check whether you run baserCMS User Community baserCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93460: baserCMS stored cross-site scripting in email form fields

CVE-2026-93460 · Severity: medium · CVSS 5.4 · Published 2026-09-30

baserCMS is a web content management system used to build and manage websites. A stored cross-site scripting (XSS) vulnerability in email form fields allows attackers to inject malicious scripts that execute in the browsers of users viewing the site, potentially stealing credentials or defacing content. The vulnerability affects versions 5.0.0 through 5.4.0 and requires updating to version 5.3.1 or later to remediate.

Technologies: baserCMS User Community baserCMS. Vendors: baserCMS User Community.

Quick answers

Is CVE-2026-93460 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93460 being exploited in the wild.
How severe is CVE-2026-93460?: Medium severity, with a CVSS score of 5.4, published 30 September 2026.
Which products and versions are affected?: baserCMS User Community baserCMS 5.0.0 through 5.4.0.
Is there a fix for CVE-2026-93460?: A patch was published on 2026-09-24: Fix available in baserCMS 5.3.1 and 5.4.1 or later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93460 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-93460?: Check whether you run baserCMS User Community baserCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Stored cross-site scripting vulnerability in mail form field handling due to insufficient output escaping of appended strings. An attacker with access to submit form data can inject arbitrary JavaScript that persists in the database and executes in the browsers of all users viewing the affected page. The vulnerability is mitigated in baserCMS 5.3.1 and 5.4.1 or later.

Affected products

baserCMS User Community baserCMS 5.0.0 through 5.4.0

Timeline

2026-09-24: disclosed
2026-09-24: patched: Fix available in baserCMS 5.3.1 and 5.4.1 or later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.