QuickCMS version 6.8 is vulnerable to multiple stored cross-site scripting (XSS) issues in its language editor functionality. An attacker with administrative privileges can inject arbitrary HTML and JavaScript code that will be executed on every page. By default, the admin user cannot add JavaScript, but this vulnerability bypasses that restriction. Other versions may also be vulnerable, but only version 6.8 has been confirmed. No patch or vendor response detailing affected versions has been provided.