A stored Cross-site Scripting vulnerability in Connect-CMS exposes the application to malicious script execution, potentially compromising user sessions and data integrity.

The application contains a Stored Cross-site Scripting (XSS) flaw in the file field of the Form Plugin. This allows an attacker to inject malicious scripts that execute in the context of an unsuspecting user's browser session.

Successful exploitation of this vulnerability could lead to unauthorized access to user sessions, data theft, or the execution of unwanted actions on behalf of authenticated administrators. Given the CVSS score of 8.2, this represents a high-severity risk that could facilitate account takeovers and disrupt the integrity of the content management system.

Immediate Action: Update Connect-CMS to version 1.41.1 or 2.41.1 immediately to patch the vulnerable file upload handling in the Form Plugin.

Proactive Monitoring: Review web server access logs for anomalous requests directed toward the Form Plugin endpoints and monitor for unexpected script execution or suspicious user activity.

Compensating Controls: Implement a strict Content Security Policy (CSP) and utilize a Web Application Firewall (WAF) to filter malicious payloads from file upload inputs until the update is deployed.

Public Exploit Available: No

The high CVSS score of 8.2 underscores the significant risk posed by this vulnerability to the security of the Connect-CMS platform. Organizations currently running affected versions are strongly advised to prioritize the application of the vendor-provided patches in versions 1.41.1 or 2.41.1 to prevent potential exploitation.