CVE-2026-115457: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in baserproject basercms

baserCMS is affected by a stored cross-site scripting vulnerability (CWE-79) in versions >=5.0.0 <5.3.2 and >=5.4.0 <5.4.2. The issue arises because global shortcode expansion runs after HTML escaping on the complete rendered page, including blog comments from unauthenticated visitors. An attacker can craft a comment containing the BcBaser.getGoogleMaps shortcode with a malicious script URL, which is then executed when another user or administrator views the article. Other shortcodes like Mail.getForm can also be abused to embed forms with valid CSRF tokens. This flaw can compromise the authenticated browser context of administrators viewing affected articles. The vulnerability has been fixed in versions 5.3.2 and 5.4.2.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the vulnerable site, potentially compromising the authenticated sessions of administrators. This can lead to unauthorized actions performed with administrator privileges. The CVSS score of 7.1 (high) reflects the network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

This vulnerability has been officially fixed in baserCMS versions 5.3.2 and 5.4.2. Users should upgrade to these or later versions to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.