A stored XSS vulnerability in Unisite CMS 5.0 allows attackers to execute malicious scripts within the context of an administrator's browser session.

The application fails to properly sanitize input within the "Report" functionality, allowing an attacker to inject stored malicious scripts. When an administrator views the report, the script executes, potentially leading to session hijacking or unauthorized administrative actions.

This vulnerability poses a significant risk as it targets the administrative interface. A successful exploit could allow an attacker to compromise administrative accounts, leading to unauthorized system configuration changes, data theft, or complete site takeover. The CVSS score of 9.6 reflects the ease and high impact of this attack vector.

Immediate Action: Upgrade to the latest version of Unisite CMS that addresses the improper input handling in the "Report" module.

Proactive Monitoring: Monitor admin activity logs for unusual script execution or unauthorized changes to site configurations.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter malicious payloads.

Public Exploit Available: Unknown

Given the potential for administrative account compromise, immediate remediation is required. Security teams should prioritize patching the CMS and auditing recent administrative logs for signs of malicious activity.