CVE-2026-4225: CMS Made Simple User Management listusers.php cross site scripting
A security flaw has been discovered in CMS Made Simple up to 2.2.21. Impacted is an unknown function of the file admin/listusers.php of the component User Management Module. Performing a manipulation of the argument Message results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4225?
CVE-2026-4225 is classified as a cross-site scripting vulnerability that poses moderate risk to users.
How do I fix CVE-2026-4225?
To fix CVE-2026-4225, update CMS Made Simple to version 2.2.22 or later to mitigate the vulnerability.
What version of CMS Made Simple is affected by CVE-2026-4225?
CMS Made Simple versions up to and including 2.2.21 are affected by CVE-2026-4225.
What component is impacted by CVE-2026-4225?
CVE-2026-4225 impacts the User Management Module, specifically the file admin/listusers.php.
How can CVE-2026-4225 be exploited?
CVE-2026-4225 can be exploited through manipulation of the 'Message' argument, allowing an attacker to execute malicious scripts in a user's browser.