Vulnerability · Published Dec 18, 2025 · Assigned by VulnCheck
CVE-2023-53936Cameleon CMS 2.7.4 Authenticated Persistent Cross-Site Scripting via Post Creation
Medium 4.8
In plain English
A medium-severity cross-site scripting in Cameleon CMS from tuzitio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.2%top 83.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Cameleon CMS 2.7.4 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts into post titles. Attackers can create posts with embedded SVG scripts that execute when other users mouse over the post title, potentially stealing session cookies and executing arbitrary JavaScript.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tuzitio | Cameleon CMS | 2.7.4 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
References
- ExploitDB-51446 exploit
- Product GitHub Repository product
- VulnCheck Advisory: Cameleon CMS 2.7.4 Authenticated Persistent Cross-Site Scripting via Post Creation third-party-advisory