Multiple stored cross‑site scripting flaws exist in the submit_add_user.asp endpoint of DDSN Interactive Acora CMS version 10.7.1. An attacker can inject arbitrary HTML or JavaScript into the First Name and Last Name parameters, which are stored and later rendered when the data is viewed, compromising the confidentiality, integrity, and availability of the application.

DDSN Interactive Acora CMS v10.7.1 is the only version confirmed vulnerable. Web installations exposing the submit_add_user.asp endpoint to users are impacted; no other vendors or products are reported to be affected.

The CVSS score of 5.4 denotes moderate risk, while the absence of an EPSS measurement and a KEV listing indicates limited known exploitation. The attack path involves submitting a crafted payload to submit_add_user.asp, after which any user who views the stored data will execute the injected script. If the endpoint is publicly reachable, the threat surface is broad, necessitating prompt remediation.