CVE-2025-50754 Details

A stored Cross-Site Scripting vulnerability has been identified in Unisite CMS version 5.0, specifically within the 'Report' feature. This vulnerability allows an attacker to inject a malicious script that is executed in the admin panel when viewed by an administrator. Exploitation of this issue could hijack the admin session, and using the template editor, upload and execute a PHP web shell on the server, resulting in full remote code execution.

As of now, no official patch is available from the vendor. However, it is recommended to sanitize and escape all user input rendered in the admin panel, avoid displaying untrusted HTML or JavaScript, enforce a strict Content Security Policy, and limit access to sensitive features like the template editor.