The vulnerability is a reflected cross‑site scripting flaw in the WellChoose Single Sign‑On Portal System that allows an authenticated remote attacker to embed and execute arbitrary JavaScript in a user's browser when the user clicks a phishing link. This client‑side code injection can compromise the integrity of the user’s session, steal credentials, or perform other malicious actions within the context of the authenticated session. The weakness is a classic input‑validation failure (CWE‑79).

All installations of the WellChoose Single Sign‑On Portal System running a version earlier than IFTOP_P4_181 are affected, as the vendor recommends updating to that version or later to fix the flaw.

The listed CVSS score of 4.8 indicates moderate severity; however, exploitation requires the victim to be authenticated and to click a crafted link. The EPSS score of less than 1% suggests a very low probability of widespread exploitation, and the vulnerability is not in the CISA KEV catalog. Nonetheless, because the flaw can be triggered through phishing, the risk remains significant for environments where users may be exposed to social engineering attacks. The attack vector is limited to user interaction and authenticated sessions, but the impact on confidentiality and integrity can be substantial if successful.