Essa vulnerability allows an attacker to store malicious JavaScript by injecting it into the website or comment fields of a comment. The unsanitized input, lacking proper escaping of single and double quotes, can break out of an HTML attribute on the page and bind arbitrary event handlers such as onmouseover or onclick. When a victim loads a page containing the comment, the injected script runs in the context of the site, potentially defacing the page, stealing credentials, or redirecting to malicious sites. The flaw is a classic stored XSS, controlled by the attacker but displayed to all visitors, leading to confidentiality and integrity compromise. The associated weaknesses are improper input validation (CWE‑116) and lack of output escaping (CWE‑79).

Isso commenting server. Any version of Isso prior to commit 0afbfe0691ee237963e8fb0b2ee01c9e55ca2144 is affected. The vulnerability exists in the website field, comment edit endpoint (PUT /id/), and moderation edit endpoint (POST /id//edit/).

The CVSS score of 6.1 indicates a medium severity. EPSS <1% shows a very low likelihood of exploitation at the time of analysis, and it is not listed in CISA’s KEV catalog. Likely attack vectors are web‑based: an attacker can submit a comment or edit an existing one when authentication or moderator approval is possible. If moderation is disabled, unauthenticated users can publish comments, raising the exploitation bar. The stored nature of the payload means the impact persists for all page visitors until the comment is removed or the site is updated.