Vulnerability · Published May 16, 2026 · Assigned by VulnCheck

CVE-2020-37238CMS Made Simple 2.2.15 Stored XSS via SVG File Upload

Medium 6.4

In plain English

A medium-severity cross-site scripting in CMS Made Simple from Cmsmadesimple. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.2%top 84.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CMS Made Simple 2.2.15 contains a stored cross-site scripting vulnerability that allows authenticated users with Content Manager access to inject malicious scripts through SVG file uploads. Attackers can upload SVG files containing embedded JavaScript to the file manager, which executes when other authenticated users access the uploaded file, enabling cookie theft and session hijacking.

Affected products (as reported)

Vendor	Product	Versions
Cmsmadesimple	CMS Made Simple	2.2.15

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

ExploitDB-49199 exploit
Official Product Homepage product
Product Reference product
VulnCheck Advisory: CMS Made Simple 2.2.15 Stored XSS via SVG File Upload third-party-advisory