CVE-2026-93460
Received Received - Intake

Stored XSS in baserCMS via Email Form Fields

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: JPCERT/CC

Description
Stored Cross-site scripting via appended strings in email form fields vulnerability exists in baserCMS . If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser may be caused.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-93460
EUVD
EUVD-2026-89662

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
basercms basercms to 5.4.1 (exc)
basercms basercms to 5.3.1 (exc)
basercms basercms 5.4.1
basercms basercms 5.3.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in baserCMS versions 5.0.0 to 5.4.0. It occurs when unescaped strings in email form fields allow malicious scripts to be stored on the server. When users view affected pages, the stored scripts execute in their browsers.

Detection Guidance

To detect this vulnerability, check if your baserCMS version is between 5.0.0 and 5.4.0. Inspect email form fields for unescaped input that could allow script execution. Review server logs for unusual script injections in stored form data.

Impact Analysis

An attacker could exploit this to execute arbitrary scripts in users' browsers, potentially stealing session cookies, redirecting to malicious sites, or performing actions on behalf of users. This requires the admin panel to be accessible to unspecified users.

Mitigation Strategies

Immediately update baserCMS to version 5.4.1 or 5.3.1 or later. If updating is not possible, restrict access to the admin panel to prevent exploitation. Remove or sanitize any malicious scripts from stored form fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93460. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart