CVE-2025-46041 is a stored XSS vulnerability affecting Anchor CMS version 0.12.7. Attackers with low privileges can inject malicious JavaScript through the page description field accessible at /admin/pages/add. This vulnerability can lead to partial confidentiality and integrity impacts but does not affect availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, user interaction, and scope change.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the vulnerable application, potentially leading to information disclosure and modification of data accessible to the user. The vulnerability does not impact system availability. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the page creation interface to trusted users only and consider applying input validation or sanitization controls if possible.