CVE-2021-38708

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS.