A stored XSS vulnerability in Unisite CMS 5.0 allows unauthenticated attackers to execute malicious scripts in the context of an administrator's session.

The vulnerability exists in the "Report" functionality, where unsanitized user input is stored and subsequently rendered in the administrative interface, allowing for script execution.

A successful exploit allows an attacker to hijack administrator sessions, steal session cookies, or perform unauthorized administrative actions within the CMS. With a CVSS score of 9.6, this vulnerability poses a major risk to the integrity and confidentiality of the content management system.

Immediate Action: Update to the latest version of Unisite CMS that addresses this XSS vulnerability or apply the vendor-provided security patch.

Proactive Monitoring: Inspect the application's reporting logs for suspicious script tags or obfuscated JavaScript within user-submitted content.

Compensating Controls: Implement a Content Security Policy (CSP) and use a Web Application Firewall (WAF) to filter and block malicious script payloads from reaching the application.

Public Exploit Available: Yes (GitHub PoC repository exists)

Due to the availability of a public proof-of-concept and the critical nature of the flaw, administrators must prioritize updating the CMS. Organizations should treat this as an urgent requirement to prevent unauthorized administrative access and potential site-wide compromise.