The flaw resides in the groupe_save.php endpoint of SOPlanning 1.52.00. An attacker can supply a crafted groupe_id value that is reflected unescaped into the resulting page, enabling arbitrary JavaScript execution in the visitor’s browser. This permits the attacker to run scripts in the context of any authenticated user that visits the injected page. The primary impact is the potential loss of confidentiality, integrity, and session compromise. The likely attack vector is a victim visiting a URL or submitting a form containing the malicious groupe_id – this inference is based on typical XSS exploitation patterns.

SOPlanning version 1.52.00. No vendor was specified by the CNA; the product is publicly hosted and the exploit reference points to a GitHub repository. Any installation exposing process/groupe_save.php is vulnerable if running this version.

The CVSS score is 5.4, and the EPSS score is < 1%, indicating a moderate severity and a low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require social engineering to convince a user to submit the attack payload. Once executed, the script runs with the privileges of the victim, potentially enabling data exfiltration, session hijack, or further in‑application actions.