The vulnerability allows an authenticated attacker to store malicious HTML or JavaScript in the FirstName and LastName fields during profile editing. When a page containing the edited profile is viewed, the injected script is executed in the visitor’s browser, potentially leading to session hijacking, cookie theft, defacement or other client‑side abuse. The weakness is identified as a stored XSS flaw (CWE‑79).

Raytha CMS from the vendor Raytha is affected. All releases before version 1.4.6 contain the flaw; the issue is fixed in 1.4.6 and later. No other product variants or vendors are listed.

The CVSS v3.1 score of 5.3 indicates moderate severity. The EPSS score is less than 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not included in the CISA KEV catalog and no public exploits are documented. Attack requires authenticated access to the profile editing function, so the risk depends on the account privilege model of the installation. Overall, risk is moderate but exploitability is low under current conditions.