Roxy‑WI includes a stored cross‑site scripting flaw in the log viewer. The wrap_line and highlight_word functions build raw HTML by string concatenation with no escaping. The front‑end injects this result into the page using .html()/.append(), allowing an attacker to embed a payload that runs when an administrator opens the log viewer. The vulnerability can be used to execute arbitrary scripts in the administrative browser context, representing a Client‑Side Execution weakness (CWE‑79).

The flaw affects the Roxy‑WI web interface, which manages HAProxy, Nginx, Apache and Keepalived servers. All releases version 8.2.6.4 and earlier are vulnerable.

The vulnerability carries a CVSS score of 6.1, indicating a moderate risk. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. An attacker who can send HTTP requests to the public load balancer can inject malicious log entries; when an administrator later views those logs, the embedded payload executes in the admin’s browser, providing client‑side script execution. No public patch is available at the time of this publication, so the risk remains until remediation is applied.