CVE-2026-32734
Published: 31 March 2026
Summary
CVE-2026-32734 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Basercms Basercms. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 2.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-32734 is a DOM-based cross-site scripting vulnerability (CWE-79) affecting baserCMS, a website development framework. The flaw exists in the tag creation functionality in versions prior to 5.2.3. Published on 2026-03-31, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low complexity, and changed scope despite requiring user interaction.
Unauthenticated attackers can exploit the vulnerability remotely by crafting malicious input that triggers DOM manipulation during tag creation, typically requiring a victim to interact with a malicious link or input. Exploitation enables limited impacts on confidentiality, integrity, and availability, such as potential session hijacking or minor data alteration, with the changed scope allowing effects beyond the initial user's context.
The vulnerability has been patched in baserCMS version 5.2.3. Mitigation involves upgrading to this version or later. Detailed advisories and release notes are provided at https://basercms.net/security/JVN_20837860, https://github.com/baserproject/basercms/releases/tag/5.2.3, and https://github.com/baserproject/basercms/security/advisories/GHSA-677c-xv24-crgx.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17269
Vulnerability details
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has DOM-based cross-site scripting in tag creation. This issue has been patched in version 5.2.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
DOM-based XSS in public-facing baserCMS directly enables remote exploitation of the web app (T1190) and arbitrary JavaScript execution in the victim browser via crafted tag input (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents DOM-based XSS exploitation by validating and sanitizing malicious inputs during tag creation in baserCMS.
Mitigates DOM-based XSS by filtering and encoding outputs before DOM manipulation in the browser.
Addresses the vulnerability through timely flaw remediation by patching baserCMS to version 5.2.3 or later.