The vulnerability is a stored cross‑site scripting flaw that lets an authenticated administrator insert arbitrary JavaScript code into the First Name, Last Name, and Email fields when adding a user. When an attacker creates such a user, the malicious script is persisted and later executed by anyone who opens the User List page, allowing actions such as phishing, cookie theft, or session hijacking that can compromise the confidentiality and integrity of other users' sessions.

The affected product is Codekernel Queue Management System, version 4.0.0. The flaw resides in the user creation interface of this version.

The CVSS score of 5.1 reflects a moderate severity vulnerability that requires valid administrator credentials to exploit. Because the attacker must be an authenticated user with administrative privileges, the attack surface is restricted compared to an unauthenticated flaw. The EPSS score is not available, and the vulnerability is not listed in CISA KEV catalogs, suggesting no widespread exploitation has been documented. Nonetheless, the ability to inject scripts into a commonly viewed administrative page warrants timely remediation.