The vulnerability is a stored cross‑site scripting flaw in the oEmbed confirmation rendering workflow of HumHub Community Edition. Malicious JavaScript can be persisted and subsequently rendered to other users’ browsers when they view the confirmation page. This allows attackers to execute arbitrary code in the victim’s browser context, potentially subverting the integrity and confidentiality of the HumHub instance.

HumHub Community Edition versions 1.18.4 and 1.18.4-pl1 are affected on Linux, macOS, and Windows operating systems.

The CVSS score of 7.4 indicates high severity. The EPSS score is less than 1%, reflecting a very low but non‑zero probability of exploitation and no known widespread exploitation as it is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack surface is any user-facing interface that allows content to be submitted for oEmbed confirmation without proper sanitization; once injected, the payload is stored and later executed in other users’ browsers.