A stored cross‑site scripting vulnerability exists in the user creation functionality of the Tenda W30E V2 firmware. Insufficient input validation allows an attacker to inject malicious script into the username field, which is then saved and executed when an administrative user views the affected management page. This weakness falls under CWE-79 and can enable the execution of arbitrary JavaScript in the context of a privileged admin session, potentially leading to session hijacking, defacement, or other client‑side compromises.

The vulnerability affects Shenzhen Tenda Technology Co., Ltd. W30E V2 devices running firmware versions up to and including V16.01.0.19(5037). All affected units employ the same username assignment logic and share the same management interface where the injection is stored and later rendered.

The CVSS base score of 5.1 reflects a moderate severity due to the limited scope to administrators with access to the web interface. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Attackers must supply a crafted username and rely on an admin to view the page for exploitation. While the risk is comparatively low, the potential impact on privileged users warrants timely remediation.