In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS.
CWE-79