Kiteworks is vulnerable to a stored cross‑site scripting (XSS) flaw in its Secure Data Forms. An authenticated attacker can inject malicious JavaScript into a form that is then rendered and stored. When other users access the same form, the injected script runs in their browsers, potentially allowing session hijacking, credential theft, or other malicious actions.

The flaw affects Kiteworks Secure Data Forms within the Kiteworks Private Data Network. Any deployment using versions prior to 9.3.0 is vulnerable and should be upgraded to mitigate the risk.

The CVSS score of 5.4 indicates moderate severity, and no EPSS score is available, so the likelihood of exploitation is uncertain. The vulnerability is not listed in CISA's KEV catalog. Based on the description, the attack vector requires an authenticated user to submit malicious form data, after which other users who view the stored form could be affected.