CVE-2026-115457

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, global shortcode expansion runs over the complete rendered page, including HTML-escaped blog comments supplied by unauthenticated visitors. A comment containing the BcBaser.getGoogleMaps shortcode...

CVE-2026-115457

The baserCMS website development framework (versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2 ) is vulnerable to stored cross-site scripting (XSS) . The root cause is that global shortcode expansion occurs after HTML rendering on the complete rendered page, including HTML-escaped blog comments f...

EUVD-2026-109081

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, global shortcode expansion runs over the complete rendered page, including HTML-escaped blog comments supplied by unauthenticated visitors. A comment containing the BcBaser.getGoogleMaps shortcode...

CVE-2026-115457 baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, global shortcode expansion runs over the complete rendered page, including HTML-escaped blog comments supplied by unauthenticated visitors. A comment containing the BcBaser.getGoogleMaps shortcode...

PT-2026-122121

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, global shortcode expansion runs over the complete rendered page, including HTML-escaped blog comments supplied by unauthenticated visitors. A comment containing the BcBaser.getGoogleMaps shortcode...