A critical reflected Cross-site Scripting vulnerability in Masa CMS allows unauthenticated attackers to execute malicious scripts, potentially leading to session hijacking and data theft.

This is a reflected Cross-site Scripting (CWE-79) vulnerability occurring because the application fails to sanitize the ajax URL query parameter before rendering it in the HTML head section. The attack is unauthenticated and requires user interaction to execute.

The exploitation of this vulnerability enables attackers to perform unauthorized actions on behalf of authenticated users, including administrators. Given the CVSS score of 8.2, this represents a high risk for data compromise, session hijacking, and potential defacement of the web platform. The ability to inject scripts into the user context poses a significant threat to the integrity and confidentiality of the organization's web-based operations.

Immediate Action: Update Masa CMS to versions 7.2.9, 7.3.14, 7.4.9, or 7.5.2 to incorporate the necessary security patches.

Proactive Monitoring: Review web server logs for suspicious activity targeting the ajax query parameter, specifically looking for script tags or common XSS payload patterns.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect and block incoming requests containing malicious characters or script-based payloads within the ajax query parameter.

Public Exploit Available: No (exploit_available: unknown)

Organizations utilizing affected versions of Masa CMS should prioritize upgrading to the patched releases immediately. If an immediate patch is not feasible, the implementation of strict input sanitization via middleware or WAF-based filtering is required to prevent potential exploitation of this high-severity flaw.