A reflected XSS flaw exists in the /rss/tag/ endpoint of changedetection.io. The tag_uuid path parameter is returned unescaped in the HTTP response body when an error occurs. Because Flask sends the response with a text/html content type, browsers render and execute any JavaScript injected into the tag_uuid value. An attacker can exploit this to run arbitrary script in the context of the victim’s browser session, enabling credential theft, session hijacking, or malicious site defacement.

The vulnerability affects all installations of changedetection.io from earlier releases up to, but not including, version 0.54.4. The vendor dgtlmoon distributes the affected product as changedetection.io, a free open‑source web‑page change monitoring tool.

The CVSS score of 6.1 indicates a moderately high impact, while the EPSS score of less than 1% reflects a very low current exploitation probability. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is via a crafted URL to the /rss/tag/ endpoint that an end‑user or automated service might visit; the attacker can embed malicious payloads directly into the tag_uuid path and trick browsers into executing it.