QuickCMS version 6.8 is vulnerable to multiple stored cross-site scripting (XSS) flaws in its page editor functionality (pages-form). An attacker with admin privileges can inject arbitrary HTML and JavaScript code that executes when the edited page is viewed. By default, admin users cannot add JavaScript, but this vulnerability bypasses that restriction. The vendor has not provided details on affected versions or patches. No known exploits are reported in the wild.