A stored cross‑site scripting (XSS) flaw resides in the endpoint vets.wakyma.com/configuracion/agenda/modelo-formulario-evento of the Wakyma web application. A user who has permission to create personalized accounts can inject a malicious survey that, once stored, will be rendered to all other users, potentially harming the entire veterinary team. Additionally, a user with low privileges can exploit the vulnerability to access unauthorized data and perform actions with elevated privileges, as stated in the vendor description.

The vulnerability affects the Wakyma application web product. The provided data does not list a specific version range; the CPE entries imply all current versions may be impacted until the fix is applied.

The CVSS score is 4.8, indicating moderate severity. The EPSS score is below 1 %, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely authenticated or internal, requiring an attacker to have write access to create a malicious survey or basic user privileges to benefit from the stored XSS.