A vulnerability in Staffwiki v7.0.1.19219 allows an attacker to inject JavaScript code through a crafted HTTP request to the wff_cols_pref.css.aspx endpoint. When a victim’s browser processes the response, the malicious script runs with the user’s privileges, potentially leaking credentials, session cookies, or other sensitive data. The weakness is a classic XSS flaw (CWE‑79).

The affected product is Staffwiki, version 7.0.1.19219. No additional vendor or product data was supplied by the CNA, and no other impacted versions are listed. Users of this specific Staffwiki build should verify whether they are running this vulnerable version.

The CVSS base score of 6.1 indicates a medium severity. EPSS scores below 1% suggest the vulnerability has a low probability of exploitation in the near term, and it is not currently documented in the CISA KEV catalog. Nevertheless, the attack vector is remote; an attacker can trigger the flaw by sending a crafted HTTP request, making the vulnerability accessible over the network without prior authentication or local access. Because it executes in the victim’s browser, the impact can range from credential theft to full session hijacking, depending on what information the compromised context can reach.