Admidio 5.x stores the raw registration name in a data‑message attribute without encoding, allowing an attacker to embed a double‑quoted event handler. When an administrator hovers over that registration in the Manage registrations page, the browser executes the injected JavaScript in the administrator’s context. This can lead to session hijacking, credential theft, or defacement of the web interface. The flaw is a classic stored XSS as described by CWE‑79.

All Admidio installations running version 5.0.0 up to and including 5.0.14 are affected. The vulnerability is resolved in version 5.0.15. Users should verify that their instance is not using an affected release.

The CVSS score of 5.3 indicates a moderate threat level. EPSS data is not available, so the exact probability of exploitation is unknown, but the vulnerability is included in no CISA KEV list. The attack does not require authentication; an external user can create a malicious registration. However, the impact materializes only when an administrator views the entry, so an attacker must wait for accidental or deliberate administration of the system. The overall risk is moderate but not negligible, especially in environments with frequent administrator access to registration lists.