A cross‑site scripting flaw exists in xxl‑job‑admin version 3.0.0. The vulnerability permits a remote attacker to inject an arbitrary script via a crafted HTTP GET request, which the application processes without proper sanitization. The injected script can then be executed in the context of the application, enabling arbitrary code execution and full compromise of the host, as identified by CWE‑79.

The affected product is xxl‑job‑admin, specifically version 3.0.0. No other vendor or product versions were enumerated in the advisory.

The CVSS score of 6.1 indicates moderate severity, while an EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Attackers would need to send a malicious GET request to a vulnerable endpoint of the web interface, so the attack vector is remote via HTTP.