A stored XSS vulnerability exists in NukeViet CMS versions <4.6.00 due to improper neutralization of user input in JavaScript string literals embedded in HTML attributes. The first_name and last_name profile fields are sanitized with HTML numeric character references, which are decoded by browsers before JavaScript parsing, allowing an attacker to break out of the string context and execute arbitrary JavaScript. This occurs in the {COMMENT.post_name} variable used inside an inline onclick handler in the comment template. An attacker with a low-privileged account can inject a payload into their profile name fields and post a comment, causing the payload to execute in any visitor's browser who clicks the Reply link on that comment. The vulnerability enables actions such as admin session hijacking, phishing, and data exfiltration. The recommended fix is to remove the vulnerable inline handler or use proper JSON encoding for the input.

An attacker with a regular user account can execute arbitrary JavaScript in the browsers of any visitors who interact with the Reply button on their comment, including administrators. This can lead to privilege escalation by hijacking admin sessions, forging administrative actions, credential phishing through fake login forms, and exfiltration of page content and non-HttpOnly cookies. Although session cookies are HttpOnly and not directly accessible, the attack remains capable of causing significant harm through other vectors.

No official patch is documented at this time. The preferred remediation is to remove the vulnerable post_name parameter from the inline onclick handler and instead retrieve the display name from the DOM within the JavaScript function. Alternatively, if passing the value inline is necessary, it must be properly escaped using JSON encoding (e.g., json_encode in PHP) to ensure safe JavaScript string literals. Relying on HTML numeric character references for JavaScript escaping is insufficient. Users should audit other code locations for similar unsafe patterns. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.