SOPlanning is vulnerable to a stored cross‑site scripting flaw through the /process/upload_backup endpoint. An authenticated attacker can upload a specially crafted ZIP archive containing a malicious user.csv file that embeds JavaScript. The injected code runs in the victim’s browser when that user clicks the Edit button for the malicious backup, allowing the attacker to execute arbitrary scripts in the context of the victim’s session and potentially exfiltrate confidential data or manipulate page content.

Vendors and products impacted are SOPlanning, specifically all releases version 1.55 and earlier.

The CVSS score of 5.1 indicates a medium‑severity vulnerability, and the EPSS score is currently unavailable, so the exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must first authenticate to the application, gain access to the backup upload feature, and then a target user must execute the Edit action on the malicious backup. Because of these prerequisites, the risk of exploitation is moderate, pending further public exploitation evidence.