A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \Exclude these IP addresses from the \Site Down\ status\ parameter under the \Maintenance Mode\ module.