TI-2026-79891 Aliases CVE-2026-115457

Stored cross-site scripting in baserCMS via blog comment shortcodes

MEDIUM 64CWE-79Published 2026-10-23 · Updated 2026-10-29

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

baserCMS from 5.0.0 before 5.3.2 and from 5.4.0 before 5.4.2 is affected. Global shortcode expansion runs over the complete rendered page, so shortcodes inside HTML-escaped blog comments still execute (CWE-79). An unauthenticated visitor can post a comment that injects a script, which runs on the site origin when another visitor or an administrator opens the article, and can act in the administrator's authenticated browser session.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, global shortcode expansion runs over the complete rendered page, including HTML-escaped blog comments supplied by unauthenticated visitors. A comment containing the BcBaser.getGoogleMaps shortcode can set apiBaseUrl to an attacker-controlled script URL, which is emitted as a script src and executes JavaScript on the site's origin when another visitor or administrator opens the article displaying that comment. Escaping raw HTML in comments does not prevent this stored cross-site scripting because shortcode processing happens after HTML rendering. Other registered shortcodes also expand in comments; Mail.getForm can embed a working contact form with a valid CSRF token. The flaw can compromise the authenticated browser context of an administrator who views the affected article. This issue has been patched in versions 5.3.2 and 5.4.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00421 36th percentileScored 2026-11-07

Fix Fixed basercms (baserproject): 5.3.2, 5.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
baserproject	basercms	5.0.0 to before 5.3.2; 5.4.0 to before 5.4.2	5.3.2, 5.4.2	Patch available	CNA

basercms Vendorbaserproject Affected 5.0.0 to before 5.3.2; 5.4.0 to before 5.4.2 Fixed in 5.3.2, 5.4.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:basercms:basercms::::::::	—	—	baserproject

cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:* Versions — — ·baserproject

Remediation

Upgrade baserCMS to version 5.3.2 or 5.4.2. The issue is patched in versions 5.3.2 and 5.4.2.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA basercms (baserproject) Fixed in 5.3.2, 5.4.2

Timeline

2026-10-23 Threatist record created from CVE-2026-115457
2026-10-24 Priority changed: MEDIUM → LOW
2026-10-29 CISA SSVC decision points changed
2026-10-29 Priority changed: LOW → MEDIUM

References

Other 4

TI-2026-53549 baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php CVSS 4.0HIGH 8.6
TI-2026-17563 baserCMS: OS Command Injection Leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.1
TI-2025-23967 baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE) CVSS 3.1HIGH 8.7
TI-2026-79890 PHP object injection in baserCMS widget-area entity CVSS 3.1HIGH 7.2
TI-2026-79888 baserCMS: Encoded path traversal bypass in the theme file API CVSS 3.1HIGH 7.2
TI-2026-79893 baserCMS web API accepts mail forms without CAPTCHA check CVSS 3.1MEDIUM 5.3

See all 78 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences