All vulnerabilities
CVE-2026-71542GHSA-vqfh-838q-xfqh

GetSimpleCMS-CE: GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php

GetSimpleCMS-CE GetSimpleCMS-CE
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 1 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.40%Chance of exploitation activity in the next 30 days, higher than 32% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published1 Oct 2026Updated 1 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting (XSS) in the "Theme to Components" functionality (admin/components.php) via the title parameter. The stored title is rendered inside a double-quoted HTML attribute in the administrative interface through an output path that HTML-entity-decodes the value before printing it, without re-encoding for the attribute context. This allows persistent execution of arbitrary JavaScript in the admin panel. At time of publication, there are no publicly available patches.

Text from CVE List

Affected versions 1

  • GetSimpleCMS-CEaffected: <= 3.3.22CVE List

References 1