The vulnerability in Kirby CMS arises from improper neutralization of input during web page generation (CWE-79). Specifically, the URL methods for KirbyTags and image blocks did not adequately filter malicious URL schemes that can lead to cross-site scripting. While simple javascript: URLs were blocked by prepending a slash, more complex variants like javascript://x%0A bypassed this protection. Other schemes such as vbscript:, data:, livescript:, mocha:, and jar: are similarly exploitable. This affects four first-party Kirby renderers that produce <a href="..."> output from editor-supplied field values. The vulnerability is resolved in Kirby versions 4.9.1 and 5.4.1.

Exploitation of this vulnerability allows an attacker to inject malicious scripts via crafted URLs in editor-supplied fields, potentially leading to cross-site scripting attacks. This can result in unauthorized script execution in the context of the affected website, impacting confidentiality and integrity of user interactions. The CVSS 4.0 score is 8.4 (high severity), indicating a significant risk with network attack vector, low attack complexity, and no privileges required but user interaction needed.

This vulnerability has been fixed in Kirby CMS versions 4.9.1 and 5.4.1. Users should upgrade to at least these versions to remediate the issue. No official temporary fixes or workarounds are indicated. Patch status is confirmed by the vendor advisory stating the fix in these versions.