Microweber CMS 2.0 contains a stored Cross-Site Scripting vulnerability that permits authenticated attackers to execute arbitrary scripts in the context of an administrator browser session.

This is a stored Cross-Site Scripting (XSS) flaw occurring within user profile fields. It requires the attacker to have low-level authenticated access to the application to inject malicious payloads.

The ability to execute arbitrary JavaScript in an administrator's browser poses a significant risk to organizational security. Successful exploitation could lead to full administrative account takeover, session hijacking, or the unauthorized modification of site content. With a CVSS score of 7.6, this vulnerability represents a high-severity threat that requires immediate attention to prevent unauthorized administrative control.

Immediate Action: As no official patch is currently available, administrators should restrict user profile editing permissions and implement strict input validation for all user-controllable fields.

Proactive Monitoring: Monitor server access logs for anomalous requests to the profile update endpoints and review administrative activity logs for unexpected script execution or account modifications.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS payloads, particularly those targeting administrative endpoints or profile update functions.

Public Exploit Available: Yes, a published proof-of-concept exists in the researcher's technical write-up on GitHub.

Given the presence of a public proof-of-concept and the potential for complete administrative compromise, this vulnerability poses a substantial risk to the integrity of the CMS. Organizations should prioritize the implementation of compensating controls, such as WAF filtering, and maintain rigorous oversight of administrative accounts until a vendor-supplied security update is released.