NamelessMC version 2.2.4 fails to encode user‑supplied input in the id parameter of the /index.php?route=/queries/user/ endpoint. The value is reflected back into the HTML response without sanitization, allowing an attacker to inject malicious JavaScript. When a victim visits a crafted URL, the script executes in the victim’s browser, giving the attacker the ability to hijack sessions, execute phishing attacks, or modify page content. The attack is a classic XSS vector that compromises the confidentiality and integrity of user sessions and the visual integrity of the site.

The vulnerable software is NamelessMC, a web platform for Minecraft servers. Only version 2.2.4 is impacted; the issue was resolved in 2.2.5. No other versions were listed as affected.

With a CVSS score of 4.3, the vulnerability is categorized as moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no public exploits have been identified. The attack vector is remote and straightforward: an attacker simply needs to craft a URL containing malicious JavaScript and convince a user to visit it. No authentication or local access is required, making this a widely exploitable threat if the vulnerability remains unpatched.