The flaw in wlc’s print_html function inserts API response data into an HTML document without escaping special characters, allowing an attacker to embed arbitrary script or HTML that will execute when the output is rendered in a browser. This stored cross‑site scripting flaw can lead to client‑side code execution against anyone viewing the generated HTML.

The vulnerability is limited to WeblateOrg’s wlc command‑line client in any release older than version 2.0.0. Version 2.0.0 and later include a patch that properly escapes API data before embedding it in the HTML output.

The CVSS score of 5.1 signals moderate severity and the absence of a EPSS value or KEV listing suggests the risk of widespread exploitation is low to moderate. The likely attack vector requires an attacker to supply malicious API data, which would normally be performed via an authenticated API write operation (this requirement is inferred from the fact that the flaw involves API response data). If an attacker gains such write access, the malicious content will be stored and later rendered, resulting in the stored XSS described above.