CVE-2022-42096

Deeper analysis

Backdrop CMS version 1.23.0 contains a stored cross-site scripting vulnerability that is triggered through Post content. The flaw is tracked as CWE-79 and carries a CVSS 3.1 score of 4.8, reflecting network attack vector, low attack complexity, high privileges required, and required user interaction with changed scope but only limited confidentiality and integrity impact.

An authenticated user with sufficient privileges to create or edit posts can insert malicious script payloads that are later rendered and executed in the browsers of other users who view the affected content, enabling limited client-side actions such as data theft or interface manipulation within the application’s security context.

Public references point to the Backdrop project site and the 1.23.0 release tag, while independent reports including a proof-of-concept repository and technical write-up document the issue; no explicit patch or mitigation statements are supplied in the available references. The EPSS score rose from low values to a peak of 0.2379 on 2026-05-10 before receding to the current 0.0683, indicating a period of increased exploitation interest after disclosure.