CVE-2026-85382: Cross Site Scripting in light0011 cms

This vulnerability in light0011 CMS arises from improper handling of the content argument in the htmlspecialchars_decode function within the Chapter Content Output component. Manipulating this argument can lead to cross-site scripting, enabling remote attackers to inject malicious scripts. The CMS follows a rolling release approach, and no specific version information or patches have been provided by the vendor. The vulnerability is tracked as CVE-2026-85382 and has a CVSS 3.1 base score of 5.3 (medium severity). Although exploit code is public, no known active exploitation has been reported.

Successful exploitation allows remote attackers to perform cross-site scripting attacks, potentially leading to execution of arbitrary scripts in the context of the affected application. This can result in session hijacking, defacement, or other client-side impacts. The vulnerability requires user interaction (UI:P) and has low complexity (AC:L), with no privileges required (PR:N).

No official patch or fix has been released by the vendor as of the latest information. Users should monitor the vendor's communications for updates. In the meantime, applying input validation or output encoding workarounds at the application level may reduce risk. Given the rolling release model, users should update promptly once a fix is available. Since the vendor has not responded yet, caution and temporary mitigations are advised.