CVE-2021-36654: CMSuno 1.7 is vulnerable to an authenticated stored cross site scripting in modifying the filename paramete...

Security readout for executives and security teams

CMSuno 1.7 has an authenticated stored cross-site scripting issue in the theme update workflow. A logged-in user can persist unsafe content through the filename-related parameter, potentially causing script execution for later viewers of the affected interface. Exposure is most relevant to CMSuno 1.7 sites where authenticated users can access theme update functionality. Risk increases if administrative access is broadly shared or reachable from the internet. Treat this as a targeted web application risk, not an internet-wide emergency. Prioritize if CMSuno 1.7 is still used in production or if multiple users can access theme administration. Mitigation focus: Check CMSuno project guidance for a fixed release or workaround.; Restrict theme update access to trusted administrators only.; Limit administrative interfaces with VPN, SSO, or IP restrictions where feasible..

Prepared

Jun 2, 2026, 19:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.