CVE-2021-41948: 
PHP vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS <= 4.2.1 version via "List of subjects". The vulnerability was discovered and disclosed on September 28, 2021, and was assigned identifier CVE-2021-41948 (MITRE CVE).

The vulnerability is a stored XSS that can be exploited through the admin panel's contact form configuration. Specifically, the "List of subjects" field in the contact form settings does not properly sanitize user input, allowing for the injection of malicious JavaScript code (GitHub Issue).

When successfully exploited, this vulnerability allows attackers to inject and execute arbitrary JavaScript code in the context of other users' browsers who visit the contact page. This could lead to session hijacking, credential theft, or other client-side attacks against site visitors.

Users should upgrade their Subrion CMS contact us plugin to a version newer than 4.2.1. Until an upgrade is possible, administrators should carefully validate any input in the "List of subjects" field and avoid using any HTML or JavaScript code in this field.