CVE-2026-32734: baserCMS Vulnerable to DOM-based Cross-site Scripting
Summary
CVE-2026-32734: baserCMS is Vulnerable to Cross-site Scripting. Affects baserproject/basercms versions < 5.2.3. Fixed in 5.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
baserCMS is an open-source content management system (CMS) designed for building and managing websites. It offers a user-friendly interface, customizable themes, and various plugins to enhance functionality. However, versions 5.2.2 and earlier are susceptible to a DOM-based cross-site scripting (XSS) vulnerability, which can be exploited by attackers to execute malicious scripts.
Vulnerability Detail
The vulnerability arises during the tag creation process in baserCMS, where user input is not properly sanitized. This oversight allows an attacker to inject malicious JavaScript code, which can be executed in the context of the user's browser. The ramifications include unauthorized actions on behalf of the user, data theft, and potential compromise of user accounts. The vulnerability is classified under CWE-79, indicating its nature as a cross-site scripting issue.
How To Fix
Minimum fixed version
5.2.3
This is the first release that contains the fix.
composer require baserproject/basercms:5.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid creating tags with untrusted input until the update is applied. Additionally, implementing input validation and sanitization on the client-side can help mitigate the risk of XSS attacks.
Conclusion
In summary, baserCMS versions 5.2.2 and earlier are vulnerable to a DOM-based cross-site scripting vulnerability that can lead to serious security issues. Users are strongly advised to update to version 5.2.3 or later to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for baserproject/basercms →
FAQ
baserCMS is an open-source content management system that allows users to create and manage websites easily.
A DOM-based XSS vulnerability occurs when an attacker can inject malicious scripts into a web application, which are then executed by the user's browser.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences include unauthorized actions, data theft, and potential account compromise for users of the affected baserCMS versions.
The CVSS score for this vulnerability is 7.1, indicating a high severity level that requires prompt attention.
Related vulnerabilities
Recent vulnerabilities recorded for baserproject/basercms.
