A stored cross‑site scripting flaw exists in the user profile fields of the Open eClass platform. Authenticated students can inject arbitrary JavaScript that is saved by the system and executed when other users view the affected pages. This can lead to theft of credentials, session hijacking, or defacement of the application, as the injected code runs in the context of the victim’s browser. The weakness is a classic input‑validation defect identified as CWE‑79.

The vulnerability was present in all releases of Gunet's Open eClass platform older than version 4.2. The issue was addressed in the 4.2 release with a patch that sanitizes profile input and prevents script execution.

The CVSS score of 7.3 indicates a high overall severity. The EPSS score of less than 1 % suggests that, at the time of this analysis, the likelihood of exploitation is currently very low and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated user who can modify profile fields, after which any viewer of that profile could be affected. The high impact combined with a low exploitation probability results in a moderate to high overall risk if the platform receives widespread use without the vendor update.