Medium severity · published Sep 30, 2026
CVE-2026-93460
A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS
5.4
CVSS
0.1%
EPSS
No
On KEV
Description
A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
baserCMS · baserCMS User Community
before 5.4.1; before 5.3.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93460
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93460
jvn.jp
https://jvn.jp/en/jp/JVN14353754
basercms.net
https://basercms.net/security/JVN_14353754
More from baserCMS
5.4
CVE-2026-93464
A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS
5.4
CVE-2026-93463
A cross-site scripting vulnerability via script validation bypass exists in baserCMS
5.3
CVE-2026-93462
A missing authentication for critical function vulnerability exists in baserCMS