The flaw allows an authenticated user to inject arbitrary HTML into their own font‑family preference, which is then rendered on every page. The injected code is therefore stored and reflected, giving the attacker a stored XSS vector. If combined with the separate CSP bypass vulnerability disclosed as GHSA‑9c3j‑xm6v‑j7j3, the attacker could also hijack the victim’s account. As a result, the primary impact is the exposure of sensitive information and the potential loss of Credential and session data through account takeover.

The vulnerability affects Mantis Bug Tracker installations spanning versions 2.11.0 through 2.28.1. The defect was incorporated into the source code delivered in 2.28.2, which contains the necessary fix. Users running any affected version are therefore at risk until they upgrade or apply a mitigation.

The CVSS score of 7.2 indicates a high severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified from the data. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be an authenticated user capable of editing the font‑family setting, after which the stored payload is executed in the context of every visited page. The attack requires no special privileges beyond user authentication, enabling the attacker to achieve account compromise if a CSP bypass is active.