Wirtualna Uczelnia suffers from a reflected cross‑site scripting flaw caused by improper handling of the locale parameter on several endpoints. An attacker can embed a malicious script in the locale value, which the application reflects unescaped back to the victim’s browser. When the victim opens the crafted URL, the injected JavaScript runs in the victim’s context, potentially allowing data theft, session hijacking, or the delivery of further malicious payloads.

The vulnerability affects the Simple SA Wirtualna Uczelnia product, specifically all releases up to and including wu#2016.437.295#0#20260327_105545. No newer versions are indicated in the data.

The CVSS score of 5.1 denotes a medium severity, and the entry is not listed in the CISA KEV catalog. EPSS data is not available, implying no recent exploitation reports. The most likely attack vector is an attacker sending a malicious link to a user who then opens it; thus the vulnerability requires user interaction and is classified as a client‑side, reflected XSS.