wger, the open‑source workout manager, stores user‑supplied license information directly into HTML without escaping. An authenticated user can insert a malicious string as the license_author field while creating an ingredient, and the page is rendered using Django’s |safe filter so the injected script runs in the browsers of all viewers, giving the attacker the ability to steal session cookies, deface the site, or launch phishing attacks. This flaw is a classic Stored XSS attack (CWE‑79) that compromises confidentiality, integrity, and availability of the client’s web session.

The vulnerability exists in the wger application up to version 2.4. All installations running 2.4 or earlier are affected; the released 2.5 version contains the fix and is not vulnerable.

The CVSS score is 5.1, placing the flaw in the moderate severity range. EPSS data is not available and the issue is not listed in CISA’s KEV catalog, indicating no documented large‑scale exploitation. The attack requires only an authenticated user with the ability to create ingredients – a common role on most installations – and the injected script will execute in every browser that accesses the compromised ingredient, making the risk significant for shared instances.