Smoothwall Express versions prior to 3.1 Update 13 contain a stored cross‑site scripting flaw in the /cgi‑bin/vpnmain.cgi script. The VPN_IP parameter is not properly sanitized, which allows an authenticated user to inject arbitrary JavaScript into VPN configuration settings. When other users view the affected page, the malicious script executes within their browsers, potentially exposing credentials or session data.

The vulnerability affects all Smoothwall Express builds with a version number less than 3.1 Update 13, including releases 3.1 Update 0 through Update 12 and any older pre‑3.1 versions. System administrators should confirm the exact build in use and plan an update.

The flaw has a CVSS base score of 5.1, indicating moderate risk. The EPSS score is below 1 %, implying a low probability of exploitation. It is not listed in the CISA KEV catalog. An attacker must first authenticate to the management interface and possess permissions to modify VPN settings in order to inject malicious code; thus the threat requires insider or compromised‑user access rather than remote exploitation. Nonetheless, the stored XSS can lead to credential theft and session hijacking for other users viewing the vulnerable page.