A stored cross‑site scripting flaw exists in a user interface component of Pega Platform. The vulnerability allows an attacker who can gain administrative access to inject malicious script that is persisted and executed in the browsers of other users who view the affected interface. Because the attacker merely injects client‑side code, the result is a potential phishing or cookie theft scenario, which in turn can lead to low‑level confidentiality compromise and no direct influence on data integrity.

Pegasystems Pega Infinity, versions 8.1.0 through 25.1.0 are affected by this flaw.

The CVSS score of 4.8 indicates a low risk level, and the EPSS score of less than 1% reflects a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires administrative rights; therefore the attack vector is limited to privileged accounts. While the impact to confidentiality is low, the presence of administrative access raises the overall risk for organizations that rely on these versions.