A stored cross‑site scripting vulnerability resides in the user profile text fields of Altium Live. Insufficient server‑side sanitization allows authenticated users to inject arbitrary HTML and JavaScript. When an impacted profile is viewed, the payload is executed in the victim’s browser, enabling session token theft, phishing, or malicious redirects. The weakness is a classic input validation flaw.

Altium Live is the affected product, specifically version 1.2.2. The issue is present in the user profile editing functionality of Altium 365, requiring an authenticated user to supply malicious content.

The CVSS score of 7.6 indicates a high severity. The EPSS score is below 1 %, suggesting exploitation is unlikely but not impossible; it is not listed in the CISA KEV catalog. Exploitation demands an authenticated account and a victim who visits the altered profile, so the attack vector is limited to social‑engineering or internal user interaction. The vulnerability’s impact is confined to the user’s browser context, but it can lead to credential compromise and further lateral movement.