CVE-2026-93460
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If exploited, an arbitrary script may be executed in the user's web browser.
Risk Assessment
Stored XSS can lead to session theft, account takeover, or malicious actions within the victim's browser context. The risk affects users viewing the infected content.
Recommendation
Update baserCMS to a version containing the fix for this vulnerability. Implementing input sanitization and validation mechanisms in email forms is also recommended.
Other vulnerabilities in baserCMS
See all- CVE-2026-97150High
When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes 'config.php' from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.
- CVE-2017-10844High
baserCMS versions 3.0.14 and earlier, 4.0.5 and earlier allow an attacker to execute arbitrary PHP code on the server via unspecified vectors.
- CVE-2017-10843High
baserCMS versions 3.0.14 and earlier, 4.0.5 and earlier allow remote attackers to delete arbitrary files via unspecified vectors when the 'File' field is being used in the mail form.
- CVE-2016-4882High
CSRF vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- CVE-2016-4878High
The CSRF vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- CVE-2016-4876High
Version 3.0.10 and earlier of baserCMS contains a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack the authentication of administrators and execute arbitrary PHP code via unspecified vectors.
- CVE-2017-10842Critical
A SQL injection vulnerability in baserCMS versions 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- CVE-2026-93464Medium
A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If exploited, an arbitrary script may be executed in the user's web browser.
- CVE-2026-93463Medium
A cross-site scripting vulnerability via script validation bypass exists in baserCMS. If exploited, an arbitrary script may be executed in the user's web browser.
- CVE-2026-93462Medium
A missing authentication for critical function vulnerability exists in baserCMS. If exploited, a remote attacker may obtain sensitive information.
Original NVD description (English source)
A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS