CVE-2026-115457: baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, global shortcode expansion runs over the complete rendered page, including HTML-escaped blog comments supplied by unauthenticated visitors. A comment containing the BcBaser.getGoogleMaps shortcode can set apiBaseUrl to an attacker-controlled script URL, which is emitted as a script src and executes JavaScript on the site's origin when another visitor or administrator opens the article displaying that comment. Escaping raw HTML in comments does not prevent this stored cross-site scripting because shortcode processing happens after HTML rendering. Other registered shortcodes also expand in comments; Mail.getForm can embed a working contact form with a valid CSRF token. The flaw can compromise the authenticated browser context of an administrator who views the affected article. This issue has been patched in versions 5.3.2 and 5.4.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
baserCMSto a version that resolves this vulnerability.Fixed in 5.3.2 - Upgrade
Upgrade
baserCMSto a version that resolves this vulnerability.Fixed in 5.4.2
Event History
Frequently Asked Questions
Which deployments are affected?
baserCMS versions 5.0.0 before 5.3.2 and versions 5.4.0 before 5.4.2 are affected. The issue requires blog comments to be rendered on an article page that a visitor or administrator opens.
What does an attacker need to exploit this issue?
An attacker needs only to submit a blog comment containing the BcBaser.getGoogleMaps shortcode; no authentication is required. When the comment is displayed, the shortcode can cause a script from an attacker-controlled URL to execute in the viewing user's browser.
Does HTML escaping of comments prevent exploitation?
No. Comments may be HTML-escaped, but global shortcode processing occurs after page rendering and expands shortcodes contained in the comment.
What is the impact if an administrator views a malicious comment?
The attacker-controlled JavaScript executes on the site's origin in the administrator's authenticated browser context. Other registered shortcodes can also be expanded in comments; for example, Mail.getForm can embed a functional contact form with a valid CSRF token.
What versions remediate the issue?
Upgrade to baserCMS 5.3.2 or 5.4.2, depending on the release branch in use. These versions include the patch for shortcode expansion in comments.