CVE-2026-115457

Name of the Vulnerable Software and Affected Versions baserCMS versions 5.0.0 through 5.3.1 baserCMS versions 5.4.0 through 5.4.1

Description Global shortcode expansion processes the entire rendered page, including HTML-escaped blog comments from unauthenticated users. This allows stored cross-site scripting (XSS) because shortcode processing occurs after HTML rendering. An attacker can use the BcBaser.getGoogleMaps shortcode to set the apiBaseUrl variable to a malicious script URL, which executes JavaScript on the site origin when a visitor or administrator views the comment. Additionally, the Mail.getForm shortcode can be used to embed a contact form with a valid CSRF (Cross-Site Request Forgery) token, which is a technique to trick a user into performing actions they did not intend. This can compromise the authenticated browser context of an administrator.

Recommendations Update baserCMS versions 5.0.0 through 5.3.1 to version 5.3.2. Update baserCMS versions 5.4.0 through 5.4.1 to version 5.4.2.