CVE-2021-47733: Cmsimple

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

CMSimple 5.4 contains a cross-site scripting vulnerability that allows attackers to bypass input filtering by using HTML to Unicode encoding. Attackers can inject malicious scripts by encoding payloads like ')-alert(1)// and execute arbitrary JavaScript when victims interact with delete buttons.

Affected products

• Cmsimple Cmsimple: version 5.4 only

Published 2025-12-23. Last modified 2026-06-17.