GigToDo version 1.3 contains a persistent cross‑site scripting flaw that lets authenticated users inject JavaScript and HTML into the proposal description field. When the content is later displayed by administrators or any user, the payload runs in the victim’s browser, allowing for cookie theft and malicious redirects.

The vulnerability affects the GigToDo Freelance Marketplace Script, specifically version 1.3. No other versions are listed as impacted.

The vulnerability is rated with a CVSS score of 5.1, indicating a medium severity. The exploit requires the attacker to be authenticated and have permission to create proposals, and it relies on the application’s failure to escape stored HTML. No EPSS score is available, and the issue is not currently listed in CISA’s KEV catalog, suggesting that widespread exploitation is not confirmed. Nevertheless, because the flaw allows code execution in the browser context of privileged users, the risk remains moderate with potential confidentiality and integrity impacts on user sessions.