A persistent Cross-Site Scripting vulnerability in Publii CMS exposes site visitors to unauthorized script execution, posing a high risk to user integrity and session security.

This is a persistent Cross-Site Scripting (XSS) vulnerability occurring due to unsanitized input in configuration fields such as Site Description and Footer Follow Buttons. The vulnerability requires an authenticated attacker with sufficient privileges to modify configuration settings to inject malicious payloads.

Successful exploitation allows an attacker to execute arbitrary JavaScript within the context of a victim's browser session. This can lead to session hijacking, defacement of the static site, or the redirection of visitors to malicious external domains, severely damaging user trust and site integrity. Given the CVSS score of 7.3, this flaw is considered high severity due to the potential for significant impact on site visitors.

Immediate Action: Review the official Publii download portal for the latest version and apply updates immediately to ensure input sanitization controls are in place.

Proactive Monitoring: Audit administrative access logs for unauthorized changes to configuration fields and monitor web traffic for anomalous script injections originating from the site.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall to filter potentially malicious input in configuration fields.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the GitHub Gist referenced by the CVE record.

Organizations utilizing Publii CMS must prioritize this update to prevent persistent script injection. Given the existence of a public proof-of-concept, the window for proactive mitigation is closing, and administrators should verify their current build version against the vendor's security advisories without delay.