The vulnerability is a stored cross‑site scripting flaw in the oEmbed confirmation rendering workflow. An attacker can craft a malicious payload that is persisted and later rendered to other users, leading to arbitrary script execution in the victim's browser. This can result in session hijacking, data theft, or defacement, affecting confidentiality, integrity, and availability of the HumHub instance.

HumHub Community Edition versions 1.18.4 and 1.18.4‑pl1 are affected on Linux, macOS, and Windows platforms.

The CVSS score of 7.4 indicates a high severity. No EPSS score is available, so the likelihood of exploitation cannot be quantified from the data. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Attackers would need to inject malicious content into the oEmbed confirmation page, likely through a user‑facing interface that lacks proper input sanitization. Once accessed, the stored payload can execute in other users’ browsers, providing a vector for further compromise.