A cross‑site scripting flaw allows an attacker to inject arbitrary script into the web UI of Devolutions PowerShell Universal. The vulnerability is a classic CWE‑79 weakness, and if exploited it can enable client‑side code execution or visual defacement of the application interface. These consequences are inferred from the nature of XSS and are not explicitly detailed in the vendor advisory.

The issue is present in PowerShell Universal versions prior to 4.5.6 and prior to 5.6.13, as identified by the vendor advisory and the product’s CPE entry.

The CVSS score of 6.1 denotes moderate severity. The EPSS probability is less than 1 %, indicating a low likelihood of widespread exploitation at the time of assessment. The vulnerability is not listed in the CISA KEV catalog, further suggesting it has not yet been actively targeted. The likely attack vector is a web‑based one, inferred from the nature of XSS in a web UI, though the advisory does not explicitly state the method of delivery.