CVE-2020-36413

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.14

Description: A stored cross-site scripting (XSS) issue allows authenticated attackers to execute arbitrary web scripts or HTML by entering a crafted payload into the Exclude these IP addresses from the "Site Down" status parameter under the Maintenance Mode module.

Recommendations: For CMS Made Simple version 2.2.14, as a temporary workaround, consider restricting access to the Maintenance Mode module until a patch is available. Avoid using the Exclude these IP addresses from the "Site Down" status parameter in the affected module until the issue is resolved.