An authenticated stored cross-site scripting vulnerability in CamaleonCMS allows low-privileged users to compromise administrative sessions.

This is a stored cross-site scripting (XSS) vulnerability (CWE-79) triggered by injecting unsanitized HTML into the post title field during draft creation. It requires the attacker to have low-level authenticated access to the system.

An attacker can hijack administrative sessions, leading to full site compromise, unauthorized data access, or the creation of malicious administrative users. The CVSS score of 8.7 reflects the high risk of privilege escalation and persistent code execution within the administrative context.

Immediate Action: Restrict access to administrative and content creation interfaces until a vendor-supplied patch is applied.

Proactive Monitoring: Review administrative audit logs for suspicious activity or unauthorized changes to content, particularly from low-privileged user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block common XSS payloads directed at the post title input fields.

Public Exploit Available: No (exploit_available: false)

Security teams should enforce strict input validation for all user-controllable fields. Organizations using CamaleonCMS should monitor vendor release channels for a security update and apply it immediately upon availability.