The vulnerability lies in the thread posting and reply feature of YetAnotherForum.NET. The application accepts user‑supplied content and stores it without proper HTML sanitization or contextual output encoding. When a thread page is rendered, the unsanitized content is inserted directly into the page, allowing an attacker to embed arbitrary JavaScript. This results in malicious scripts executing in the browsers of any user who views the affected thread.

YAF.NET forum software from YAFNET prior to version 4.0.5 and 3.2.12 is affected. Both the 4.x and 3.x releases contain the flaw; any host running an older version should verify its installed version and plan remediation.

The CVSS score of 7.3 indicates a high risk to confidentiality, integrity, and availability for users visiting the forum. The exploit is achieved through a standard web input form and applies to every thread viewed, suggesting a non‑negligible exploitation likelihood. Although the EPSS information is not available and the vulnerability is not listed in the CISA KEV catalogue, the stored XSS can be triggered by any user submitting malicious content, creating a broad threat surface.