Savsoft Quiz 5.0 includes a persistent cross‑site scripting flaw that allows an authenticated attacker to inject malicious HTML and JavaScript into user profile fields via the edit_user endpoint. When another user opens the affected profile, the injected scripts execute in that user’s browser, potentially allowing cookie theft, session hijacking, or malicious site redirection.

The vulnerability affects Savsoft Quiz version 5.0 from the Savsoft Quiz product line. No further sub‑version details are provided.

The CVSS score of 5.1 indicates a moderate severity. Exploitation requires valid user credentials and the victim must view the compromised profile, making the exploit less likely without user interaction. An EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation but still warranting timely remediation.