The vulnerability is a stored cross‑site scripting flaw in Bynder version 0.1.394. Attackers can inject HTML or JavaScript that is retained in the application and later served to users. When an affected user views the compromised content, the injected code executes within the victim’s browser, allowing the attacker to steal credentials, deface the site, or perform other client‑side attacks. This weakness is classified as CWE‑79.

This flaw affects the Bynder web application at version 0.1.394. No other versions or vendors are listed in the CNA data. Users running this specific build are at risk.

The CVSS score of 5.4 indicates moderate severity. Exploit potential is unclear due to missing EPSS data, but the vulnerability was publicly disclosed, suggesting the risk of exploitation is non‑negligible. The issue is not yet catalogued in CISA’s KEV list, but the stored nature of the payload means that an attacker could trigger it via legitimate user interactions, making it potentially effective against unsuspecting users. The attack vector is inferred to be through the application’s content management interface, requiring user authentication and content delivery to the victim’s browser.