This vulnerability in westboy CicadasCMS involves improper handling of the argument 's' in the Search function of AbstractCacheManager.java, leading to cross-site scripting. Remote attackers can exploit this flaw to inject and execute arbitrary scripts in the context of the affected application. The product's rolling release approach means version-specific details for affected or patched releases are not provided. The vendor has not yet responded to the issue report, and no official fix or mitigation has been announced. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on confidentiality and integrity.

Successful exploitation of this vulnerability could allow remote attackers to perform cross-site scripting attacks, potentially leading to the execution of malicious scripts in users' browsers. This may result in session hijacking, defacement, or other client-side impacts. However, the impact is limited to the client side and does not affect confidentiality, integrity, or availability of the server. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from westboy. Until a fix is released, consider applying temporary mitigations such as input validation or output encoding on the affected Search function if possible.