The WeGIA application permits a stored XSS attack through the atendido_idatendido parameter in the occurrence registration page. Data supplied via this parameter is rendered directly within the Atendido selection dropdown without any sanitization. If a malicious user injects script code, that code will be persisted and later executed in the browsers of any user who views the dropdown, potentially allowing theft of session cookies, defacement, or redirection to phishing sites. The weakness is a classic input‑validation failure, identified as CWE‑79.

The vulnerability exists in all releases of WeGIA prior to 3.6.2. WeGIA is a web manager for charitable institutions that supports web‑based operations such as attendance tracking and case handling. Users running the older versions and employing the occurrence registration feature are at risk.

The CVSS score of 4.3 indicates a moderate impact with limited impact on confidentiality or integrity, and the EPSS score of less than 1 % suggests a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to inject malicious content into the attendee field, which may be facilitated by any authenticated access that allows data submission. No additional privilege escalation or remote code execution is required, but the consequence is the ability to inject arbitrary client‑side scripts for the victim users.