Stored Cross-Site Scripting Vulnerability in baserCMS Framework
CVE-2026-115457

7.1HIGH

Key Information:

Vendor

Baserproject

Status
Basercms
Vendor
CVE Published:
23 October 2026

What is CVE-2026-115457?

baserCMS framework versions prior to 5.3.2 and 5.4.2 have a vulnerability that allows stored cross-site scripting through global shortcode expansion. This flaw enables unauthenticated visitors to inject malicious comments containing a shortcode that can load an external script. The vulnerability occurs after HTML rendering, meaning that simply escaping HTML does not mitigate the risk. When another user, including an administrator, views the comment, the malicious script runs, potentially compromising their authenticated session. Users are advised to update to the patched versions for protection.

Affected Version(s)

basercms >= 5.0.0, < 5.3.2 < 5.0.0, 5.3.2

basercms >= 5.4.0, < 5.4.2 < 5.4.0, 5.4.2

References

https://github.com/baserproject/basercms/security/advisor...
x_refsource_CONFIRM
https://github.com/baserproject/basercms/commit/bec4776ab...
x_refsource_MISC
https://github.com/baserproject/basercms/releases/tag/5.3.2
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.