SOPlanning is vulnerable to reflected XSS via the taches parameter. An attacker can craft a malicious URL that, when opened by an authenticated victim, results in arbitrary JavaScript execution in the victim’s browser. This can lead to session hijacking, data theft, and manipulation of the victim’s data. The critical weakness is a reflected cross‑site scripting flaw, identified as CWE‑79.

The vulnerability affects all installations of SOPlanning version 1.55 and below. No other product versions are known to be impacted.

The CVSS score of 5.1 classifies the vulnerability as medium severity. Exploitation requires the victim to be authenticated and to click a specially crafted link, indicating a social engineering or phishing component. EPSS is not available and the issue is not listed in the CISA KEV catalog, suggesting that active exploitation in the wild has not been observed to date. Still, because the exploitation vector is accessible via a URL and requires only an authenticated user, the risk remains significant for environments that expose the application to untrusted links.