The vulnerability resides in the XssUtils.replaceHtmlCode method of the rymcu forest Article Content/Comments/Portfolio component. The method is intended to strip or replace HTML code but fails to properly escape user supplied content, allowing malicious scripts to be injected into rendered pages. An attacker can insert arbitrary JavaScript or other executable content that will run in the browsers of any user who views the affected page. This flaw is a classic cross‑site scripting vulnerability and could be used to hijack user sessions, steal cookies, or deface content.

Affected product is rymcu forest, versions up to 0.0.5. The issue is present in the src/main/java/com/rymcu/forest/util/XssUtils.java file of the Article Content/Comments/Portfolio module. No later version information is provided in the CNA data, so any instance running 0.0.5 or earlier is potentially vulnerable.

The CVSS score is 5.1, indicating moderate severity. EPSS shows less than 1% probability of exploitation, and the vulnerability is not in CISA's KEV catalogue. Based on the description, the attack vector is remote and originates from user‑supplied content that is processed by replaceHtmlCode. If exploited, the attacker could execute arbitrary scripts in the victim’s browser, compromising confidentiality and integrity of user data. The low EPSS suggests that publicly available exploits are not common yet, but the presence of a publicly disclosed proof‑of‑concept means the risk remains.