ELADMIN versions 2.7 and earlier contain a client‑side XSS vulnerability that can be triggered through the WebSocketServer, SpringSecurityConfig, and deploy.vue components. This flaw allows an attacker to inject and execute malicious JavaScript in the context of an authenticated user, which can result in session hijacking, defacement, or phishing attempts. The CVSS score of 6.1 indicates a medium severity risk for the affected system.

All installations of ELADMIN v2.7 and prior are affected. No vendor is specified in the CNA data, so organizations searching for ELADMIN should verify the versions they run and treat these as high‑risk deployments until patched.

With an EPSS score of less than 1% and no mention in the CISA KEV catalog, the probability of real‑world exploitation appears low, though it remains a legitimate threat. The attack vector is client‑side, requiring access to the web application, with no special privileges needed beyond typical authenticated usage. The lack of a public proof‑of‑concept suggests the vulnerability is still in a pre‑production state, but the medium CVSS score warrants timely action.