EIP-2026-111365

The exploit demonstrates a reflected XSS vulnerability in Plume CMS 1.2.2 by injecting a malicious script into the 'dir' parameter of the 'xmedia.php' endpoint. The lack of input sanitization allows arbitrary JavaScript execution in the context of the affected site.