GetSimpleCMS-CE: Stored Cross-Site Scripting in Theme to Components title

Summary

GetSimpleCMS-CE up to and including 3.3.22 contains a stored Cross-Site Scripting flaw in the "Theme to Components" function (admin/components.php) via the title parameter. The output is decoded from HTML entities and printed inside a double-quoted attribute without re-encoding, so a stored payload can break out of the attribute and run JavaScript in the admin panel. An attacker with access to the component editor can plant a payload that executes in the browser of other users, including administrators, when they open the Components page, which can lead to session theft and administrative actions. Per the CNA vector, no privileges are required, but the advisory describes the attack as requiring authenticated access, so the actual prerequisite should be verified against the GHSA.

Affected

• GetSimpleCMS-CE versions 3.3.22 and earlier
• Standard GetSimple CMS (non-CE) is not listed as affected

Fixed in

• Unknown. No patched version is documented at time of publication.
• Whether 3.3.23 or a later release fixes this issue is unknown.

Workaround

• No vendor-published workaround is available.
• Restrict access to the admin area by IP allow-list or VPN.
• Limit which users can edit themes and components.

Exploitation

• CISA SSVC: exploitation status "poc", automatable: no, technical impact: partial.
• Not listed in the CISA KEV catalog.
• Public proof of concept: unclear, not confirmed.

Our recommendation

• Inventory all GetSimple CE instances and their versions.
• Restrict admin panel access (VPN or IP allow-list) and enforce strong accounts with 2FA where supported.
• Check for CVE-2026-53952 (unauthenticated admin account creation, CVSS 9.8) on each instance; this is more urgent.
• Review existing component titles for unexpected script content and monitor the admin panel.
• Do not browse the admin area with privileged sessions on untrusted systems.
• Watch the GHSA advisory and NVD for a fix and re-assess when available.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-vqfh-838q-xfqh github.com
• OSV: CVE-2026-71542 osv.dev
• GetSimpleCMS-CE v3.3.22 release github.com
• GetSimpleCMS-CE February updates (3.3.23 beta) getsimple-ce.ovh
• OpenCVE: CVE-2026-71542 app.opencve.io
• Strix: CVE-2026-53952 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:16.