The django-page-cms product through version 2.0.13 exempts five administrative mutation views from CSRF protection in the pages/admin/views.py file. This exemption allows attackers to craft forged requests that modify page content without proper authorization. When signed-in editors visit a malicious page, they can be induced to store unescaped content that is rendered to all visitors, enabling stored XSS attacks. The vulnerability has a CVSS 4.0 score of 8.4, indicating high severity.

Attackers can exploit this vulnerability to perform unauthorized modifications to page content via CSRF attacks. This can lead to stored cross-site scripting, where malicious scripts are injected and executed in the browsers of all visitors to the affected pages. This compromises the integrity of the content and can lead to further attacks such as session hijacking or malware distribution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting access to the affected admin mutation views and educating editors about the risk of visiting untrusted pages. Monitoring for suspicious content changes may also help detect exploitation attempts.