A stored Cross‑Site Scripting flaw allows an attacker to inject a malicious script by entering a crafted image URL into the avatar field. When the avatar is rendered for any user, the script runs in the victim’s browser. The payload can be delivered through normal page comments or the avatar setting, enabling session hijacking or other browser‑side attacks. This weakness is described by CWE‑79 and can affect any user who views a page that displays the avatar.

The vulnerability exists in the Frappe web application framework for versions earlier than 16.11.0 and 15.102.0. Users running those releases are at risk if they use custom avatar URLs or comment functionality. All later releases contain the fix.

The CVSS score of 1.3 indicates a very low severity. The EPSS score is less than 1 %, and the vulnerability is not listed in the CISA KEV catalog, signaling a low likelihood of exploitation. The likely attack vector is via the web interface: an attacker submits a comment or avatar URL containing a malicious script, which is stored and later rendered for other users. Because the flaw requires user interaction to trigger the script, exploitation is limited to users who view the affected pages.