The Aimeos GrapesJS CMS extension is vulnerable to stored cross-site scripting, potentially allowing malicious editors to execute arbitrary JavaScript in the context of other users.

This is a stored XSS vulnerability (CWE-79) triggered via the page editor component. It requires the attacker to have editor-level privileges and relies on the absence of a restrictive Content Security Policy to execute successfully.

Successful exploitation allows an attacker with editor access to execute unauthorized scripts in the browsers of other users, including administrators. This can lead to session hijacking, unauthorized actions on behalf of the victim, or the theft of sensitive information, justifying the 7.6 CVSS score for its potential to compromise system integrity and confidentiality.

Immediate Action: Update the ai-cms-grapesjs extension to the latest patched version (2021.10.8, 2022.10.9, 2023.10.15, or 2024.10.8) as specified by the vendor.

Proactive Monitoring: Review application logs for unusual script injections or unauthorized modifications to content pages.

Compensating Controls: Ensure a strict Content Security Policy (CSP) is implemented and enforced across the web application to prevent the execution of unauthorized inline scripts.

Public Exploit Available: Unknown

Organizations utilizing the Aimeos GrapesJS extension should prioritize upgrading to the patched versions immediately. If an immediate update is not feasible, ensure that Content Security Policy headers are correctly configured to restrict script execution, thereby neutralizing the primary attack vector for this vulnerability.