OctoberCMS, a web content management system, had a stored XSS vulnerability (CWE-79) in its Event Log mail preview feature in versions before 3.7.14 and 4.1.10. The vulnerability arises because HTML content in logged mail messages was rendered inside an iframe without adequate sandboxing, enabling JavaScript execution in the context of the viewer's browser. This could allow an attacker with limited privileges to inject malicious scripts that execute when the mail preview is viewed. The vulnerability has been addressed in versions 3.7.14 and 4.1.10 by correcting the handling of the mail preview content.

Successful exploitation allows execution of arbitrary JavaScript in the browser of users viewing the Event Log mail preview, potentially leading to session hijacking, unauthorized actions, or information disclosure within the context of the affected CMS interface. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low privileges required, user interaction needed, and limited confidentiality and integrity impact.

A fix is available in OctoberCMS versions 3.7.14 and 4.1.10; users should upgrade to these or later versions to fully remediate the vulnerability. For those unable to update immediately, it is recommended to restrict mail template editing permissions to fully trusted administrators and limit Event Log viewing permissions to reduce exposure to the vulnerability.