Pega Platform versions 8.1.0 through 25.1.1 contain a stored cross‑site scripting flaw in a user interface component. An attacker who can acquire a high‑privileged user account with a developer role could inject malicious script that is persisted and executed by other users when the affected UI is rendered. The flaw falls under CWE‑79 and allows the attacker to run arbitrary client‑side code, potentially compromising confidentiality, integrity, or availability of user sessions within the Pega environment.

The vulnerability affects all Pegasystems Pega Infinity installations built from version 8.1.0 to and including 25.1.1. No specific patch versions are listed in the advisory; users should verify the installed version against the list and consider upgrading if possible.

The CVSS score of 4.8 indicates a low‑medium severity. Exploitation requires the attacker to possess a high‑privilege developer account, which limits the attack surface but still presents a significant risk if such accounts are compromised or improperly managed. EPSS information is not available and the issue is not listed in the CISA KEV catalog, suggesting that broad, automated exploitation is not currently documented. Nonetheless, the combination of high privilege and persistent XSS warrants monitoring and timely remediation.