CVE-2026-93460

Deferred Deferred - Pending Action

Stored XSS in baserCMS via Email Form Fields

Publication date: 2026-09-30

Last updated on: 2026-10-01

Assigner: JPCERT/CC

Description

A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-10-01

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-93460

EUVD

EUVD-2026-89662

Affected Vendors & Products

Vendor	Product	Version / Range
basercms	basercms	to 5.4.1 (exc)
basercms	basercms	to 5.3.1 (exc)
basercms	basercms	5.4.1
basercms	basercms	5.3.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in baserCMS versions 5.0.0 to 5.4.0. It occurs when unescaped strings in email form fields allow malicious scripts to be stored on the server. When users view affected pages, the stored scripts execute in their browsers.

Detection Guidance

To detect this vulnerability, check if your baserCMS version is between 5.0.0 and 5.4.0. Inspect email form fields for unescaped input that could allow script execution. Review server logs for unusual script injections in stored form data.

Impact Analysis

An attacker could exploit this to execute arbitrary scripts in users' browsers, potentially stealing session cookies, redirecting to malicious sites, or performing actions on behalf of users. This requires the admin panel to be accessible to unspecified users.

Compliance Impact

This vulnerability allows arbitrary scripts to execute in user browsers, which could lead to unauthorized data access or manipulation. This may violate GDPR's requirement for protecting user data integrity and confidentiality, and HIPAA's safeguards for electronic protected health information if exploited in healthcare systems.

Mitigation Strategies

Immediately update baserCMS to version 5.4.1 or 5.3.1 or later. If updating is not possible, restrict access to the admin panel to prevent exploitation. Remove or sanitize any malicious scripts from stored form fields.

Hi! I’m here to help you understand CVE-2026-93460. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70