Anchor CMS 0.12.7 · Stored Cross Site Scripting (XSS)

Impact

For European organizations using Anchor CMS 0.12.7, this vulnerability poses a moderate risk primarily to the confidentiality and integrity of administrative sessions. Attackers who gain authenticated access to the CMS backend can embed malicious scripts that execute in the browsers of other administrators or privileged users viewing the compromised pages. This can lead to session hijacking, unauthorized actions performed under the guise of legitimate admins, and potential lateral movement within the CMS environment. Given that Anchor CMS is a lightweight content management system often used by small to medium enterprises, non-profits, and personal websites, the impact may be more pronounced in organizations relying heavily on web presence and administrative integrity. The vulnerability does not directly affect availability but could indirectly cause service disruption if administrative accounts are compromised or if malicious scripts deface content. The lack of known exploits in the wild currently reduces immediate risk, but the public availability of exploit code increases the likelihood of future attacks. European organizations with limited security monitoring or weak internal access controls are particularly vulnerable.