Next Click Ventures RealtyScript 4.0.2 fails to sanitize CSV file uploads, allowing attackers to inject malicious JavaScript via the filename parameter in multipart form data. This stored cross‑site scripting enables attackers to run arbitrary code in the browsers of users who view or download the uploaded file, potentially leading to credential theft, session hijacking, or defacement. The weakness maps to CWE‑79 and has a CVSS score of 5.1, indicating moderate severity.

Affected product: Next Click Ventures RealtyScript version 4.0.2, identified by CPE cpe:2.3:a:nextclickventures:realtyscript:4.0.2. No other product versions are listed as affected.

The vulnerability's CVSS score of 5.1 and EPSS of less than 1% suggest moderate risk with low expected exploitation frequency. The attack vector is inferred to be the web‑based CSV upload interface, which does not require elevated privileges or authentication. The absence of a KEV listing indicates it has not been identified as a known exploited vulnerability in controlled environments. Administrators should consider the risk of unvalidated input leading to cross‑site scripting in user sessions.