CVE-2026-4225
Cross-Site Scripting in CMS Made Simple User Management Module
Publication date: 2026-03-16
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cms_made_simple | cms_made_simple | to 2.2.21 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-4225 is a reflected Cross Site Scripting (XSS) vulnerability in CMS Made Simple version 2.2.21, specifically in the User Management module within the admin panel file admin/listusers.php.'}, {'type': 'paragraph', 'content': "The vulnerability occurs because the code attempts to filter user input from the 'message' GET parameter by removing only the first occurrence of the '<' character using preg_replace, but it does not properly escape or sanitize the input using functions like htmlspecialchars()."}, {'type': 'paragraph', 'content': "As a result, an attacker who is authenticated in the CMS admin panel can inject malicious JavaScript code via the 'message' parameter in the URL, which will then be executed when the page is loaded."}, {'type': 'paragraph', 'content': "For example, an attacker can craft a URL with a payload such as <svg/onload=alert(document.cookie)> in the 'message' parameter, causing arbitrary JavaScript execution."}] [1, 3]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "This vulnerability allows an attacker with authenticated access to the CMS admin panel to execute arbitrary JavaScript code in the context of the admin user's browser."}, {'type': 'paragraph', 'content': "The impact includes the potential theft of sensitive information such as session cookies, which could lead to session hijacking or unauthorized actions performed with the admin's privileges."}, {'type': 'paragraph', 'content': 'Since the attack requires authentication and user interaction, the risk is somewhat limited, but it still poses a threat to data integrity and security within the CMS environment.'}, {'type': 'paragraph', 'content': 'The vulnerability has a low CVSS score indicating limited impact, but the availability of public exploits increases the risk of exploitation.'}] [1, 2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by checking for the presence of the vulnerable file admin/listusers.php in CMS Made Simple version 2.2.21 or earlier, and by testing the 'message' GET parameter for reflected cross-site scripting (XSS) behavior."}, {'type': 'paragraph', 'content': "One practical detection method is to attempt accessing the admin panel URL with a crafted payload in the 'message' parameter, such as: http://domain-name/cmscms/install/admin/listusers.php?__c=a94037876ab5f6e1527&message=<svg/onload=alert(document.cookie)>"}, {'type': 'paragraph', 'content': 'If the payload executes (e.g., an alert box appears), the system is vulnerable.'}, {'type': 'paragraph', 'content': "Additionally, Google dorking can be used to identify vulnerable targets by searching for URLs containing 'inurl:admin/listusers.php'."}, {'type': 'paragraph', 'content': 'No specific network commands are provided, but manual testing of the URL with the crafted payload while authenticated as an admin user is necessary.'}] [1, 2, 3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Currently, there are no known patches or official mitigations available for this vulnerability.'}, {'type': 'paragraph', 'content': "Immediate mitigation steps include avoiding use of the vulnerable CMS Made Simple version 2.2.21 or earlier, especially the admin panel's User Management module."}, {'type': 'paragraph', 'content': 'Consider restricting access to the admin panel to trusted IP addresses and ensure that only authorized users have admin credentials.'}, {'type': 'paragraph', 'content': "Monitor for suspicious activity and avoid clicking on untrusted links that include the 'message' parameter."}, {'type': 'paragraph', 'content': 'As a longer-term solution, consider migrating to alternative products or waiting for an official patch or update from the vendor.'}] [2]