Foxit PDF Editor Cloud, accessed via pdfonline.foxit.com, contains a stored cross‑site scripting vulnerability in the file upload feature. Malicious usernames are embedded into the list of uploaded files without proper HTML escaping, allowing an attacker to inject and execute arbitrary JavaScript whenever the file list is viewed. This can compromise user accounts, exfiltrate session data, or execute further malicious actions in the context of the victim’s browser. The weakness corresponds to CWE‑79.

The affected product is Foxit PDF Editor Cloud (pdfonline.foxit.com) running any version prior to the update released on February 3, 2026. Foxit Software Inc. is the vendor responsible for the service.

The vulnerability has a CVSS base score of 6.3, indicating moderate severity, and an EPSS score of less than 1 %, suggesting low probability of exploitation in the wild at this time. It is not listed in CISA’s Known Exploited Vulnerabilities catalog, further indicating it has not yet been widely abused. To exploit, an attacker needs to upload a file with a crafted username and then compel a user to view the upload list, which is a typical, user‑interaction dependent vector. The stored nature of the flaw means the malicious payload remains in the system until the vendor issues a fix.