Frappe before 14.99.10 15.x before 15.91.1 contains a stored cross-site scripting flaw on the leaderboard page because user names are rendered without proper neutralization. An attacker who has authenticated access can set a malicious user name that injects JavaScript when other users view the leaderboard that script executes in their browsers. The vulnerability is an instance of CWE-79 where output from user input is not properly encoded.

The vulnerability affects the Frappe application released by Frappe for versions prior to 15.91.1, including releases before 14.99.10 and all 15.x releases below 15.91.1. These versions publicly expose a leaderboard page that displays user names without sanitization. Only systems running these releases are affected.

The CVSS score of 5.1 indicates moderate severity. EPSS is unavailable, and the issue is not listed in the CISA KEV catalog. An attacker must first authenticate to the system and create or modify a user name, which is a valid prerequisite described in the advisory. Once that is done, the flaw can be exploited remotely through a normal web interface; the attack vector is server-side, no special network privileges required beyond normal application access. The moderate score reflects the limited impact scope relative to critical RCE but still represents a real security risk for users who view the leaderboard.