XXL‑JOB up through 3.5.0‑SNAPSHOT contains a stored XSS flaw in the job log list page at /joblog. An authenticated user who has permission on a chosen executor job group can inject arbitrary JavaScript through the executorParam parameter of the manual‑trigger endpoint POST /jobinfo/trigger. When another user views the job log list, the injected script runs in that user’s browser context, potentially allowing cookie theft, session hijacking, defacement, or other client‑side compromise.

The vulnerable component is the XXL‑JOB framework, affecting all releases up to and including the 3.5.0‑SNAPSHOT version. Organizations using these versions should verify their deployments against this version range.

With a CVSS score of 5.4 the risk is moderate, and the EPSS score is less than 1 %, indicating a low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Because exploitation requires authenticated access with specific executor‑group permissions, attackers need to compromise or be granted those credentials. Nonetheless, the impact on any logged‑in user who views the affected page could be significant.