SyncFusion Document Editor 30.1.37 contains a stored cross‑site scripting flaw that allows malicious code to be inserted through the comment reply field and the chat message interface. If an attacker successfully injects script, it will be executed in the browser of any user who views the affected document or chat, potentially stealing session tokens, defacing pages, or executing further attacks. The vulnerability fundamentally compromises the integrity of the user interface and the confidentiality of user data.

The affected product is SyncFusion Document Editor version 30.1.37. No other versions or products are listed as impacted.

The CVSS score of 5.4 indicates a moderate severity, while the EPSS score of less than 1% suggests low current exploit probability. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog, implying no publicly known widespread exploitation. Exploitation requires access to the application’s comment or chat features, and the attacker must deliver malicious payload via those input fields. No active exploit proof of concept is referenced in the available data.