CVE-2026-93464 is a stored XSS vulnerability in baserCMS where malicious scripts can be injected through custom content descriptions. When exploited, this can lead to arbitrary script execution in the victim's browser, potentially compromising user data confidentiality and integrity. The vulnerability affects baserCMS versions before 5.4.1 and 5.3.1. The CVSS 3.0 base score is 5.4, indicating a medium severity with network attack vector, low attack complexity, low privileges required, user interaction needed, and scope changed.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the user's browser session, potentially leading to theft of sensitive information or session hijacking. The impact is limited to confidentiality and integrity with no direct availability impact. The attack requires user interaction and low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor baserCMS vendor advisories for updates and apply patches once available. Until then, consider restricting input in custom content descriptions or applying web application firewall rules to detect and block XSS payloads.