The flaw resides in the add_definition function of Stumasy’s add_into_dictionary.php. A malicious reference argument can be crafted to inject JavaScript that is rendered later, allowing an attacker to execute arbitrary client‑side code. The CVE description confirms the vulnerability is exploitable remotely and that attack code has been publicly disclosed. The weakness is reflected in CWE‑79 (XSS) and CWE‑94 (Improper Software Interpretation), indicating improper validation and potential execution of injected code.

The project is developed by mjperpinosa and the affected product is Stumasy. Due to a rolling‑release delivery model, exact version numbers are not published; any code earlier than commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be is likely vulnerable.

The CVSS score of 5.1 denotes moderate severity, while the EPSS score of <1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely target the add_into_dictionary.php endpoint with an HTTP request that includes a crafted reference value. The description does not state whether authentication is required, so it remains uncertain whether unauthenticated users can trigger the flaw; a lack of access control could broaden the attack surface.