Vulnerability · Published May 10, 2026 · Assigned by VulnCheck

CVE-2021-47931Exponent CMS 2.6 Multiple Vulnerabilities Stored XSS Authentication

Medium 6.4

In plain English

A medium-severity cross-site scripting in Exponent CMS from Exponentcms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.2%top 88.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Title and Text Block parameters in the text editing endpoint. Attackers can inject iframe payloads with embedded SVG onload events to execute arbitrary JavaScript. The application also exposes database credentials in responses and lacks brute-force protection on authentication endpoints.

Affected products (as reported)

Vendor	Product	Versions
Exponentcms	Exponent CMS	0 – through 2.6

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

ExploitDB-50611 exploit
Official Product Homepage product
VulnCheck Advisory: Exponent CMS 2.6 Multiple Vulnerabilities Stored XSS Authentication third-party-advisory