The EZCast Pro II dongle’s Admin UI contains multiple cross‑site scripting flaws that allow an attacker to inject and execute arbitrary JavaScript in the browsers of other Admin UI users. This flaw provides client‑side code execution whenever a vulnerable user interacts with the Admin UI, potentially enabling malicious scripts to run in the context of that user’s session.

The affected product is the EZCast Pro II dongle; specifically firmware version 1.17478.146. Only devices that run this firmware are vulnerable. The device likely serves a local or access‑point network where the Admin UI is accessible over HTTP/HTTPS.

The CVSS score of 7.4 signals a high severity, but the EPSS score is below 1 %, indicating low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Attack can occur through the web‑based Admin UI, requiring a browser session with access to the dongle’s configuration interface, whether locally or via an exposed network port.