The vulnerability is a stored cross‑site scripting flaw in the profile edit feature that fails to sanitize the name field. An attacker who logs in with a low‑privilege account can inject malicious JavaScript, which is then rendered on every page that displays the user’s name. This allows the attacker to run arbitrary scripts in victims’ browsers, enabling session hijacking, credential theft, and the execution of unauthorized actions in the victims’ sessions.

Nukegraphic CMS version 3.1.2 is affected. No other versions or products are currently listed as impacted.

The CVSS score of 8.2 classifies the flaw as high severity. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local to an authenticated attacker with low privileges, who can reach other users simply by reading pages that display the compromised name. The risk remains significant because the vulnerability enables arbitrary code execution within the victims’ browser context.