CVE-2025-46041

Name of the Vulnerable Software and Affected Versions Anchor CMS version 0.12.7

Description A stored cross-site scripting (XSS) issue allows attackers to inject malicious JavaScript via the page description field in the page creation interface, specifically the "/admin/pages/add" API endpoint.

Recommendations For Anchor CMS version 0.12.7, consider disabling the page description field in the page creation interface until a patch is available. Restrict access to the "/admin/pages/add" API endpoint to minimize the risk of exploitation. Avoid using the page description field in the affected interface until the issue is resolved.