The vulnerability in ApostropheCMS's @apostrophecms/seo package (up to version 1.4.2) arises from improper neutralization of input during web page generation (CWE-79). Specifically, the Google Analytics Tracking ID and Google Tag Manager ID fields are inserted directly into script tag bodies using JavaScript template literals without sanitization or validation. Since editor-level users can modify these fields, they can inject malicious scripts that result in stored XSS affecting all visitors. The CVSS 3.1 score is 8.7 (high severity) reflecting network attack vector, low attack complexity, required privileges at editor level, user interaction required, scope changed, and high impact on confidentiality and integrity. No patch or official remediation is currently available.

Successful exploitation allows an attacker with editor-level access to inject malicious JavaScript that executes in the context of every visitor's browser. This compromises confidentiality and integrity of user data on the site. The vulnerability does not impact availability. The attack requires privileges and user interaction but can affect all site visitors once exploited.

As of the publication date, no official patch or fix is available for this vulnerability. Users should restrict editor-level access to trusted personnel only and consider additional application-level input validation or sanitization as a temporary mitigation. Monitor vendor advisories for updates regarding patches or official remediation.