In Znuny LTS before 6.5.21 and Znuny before 7.3.3, a stored cross‑site scripting flaw exists via user preferences, identified as CWE‑79. The vulnerability permits malicious code to be stored in preference fields that are rendered without sanitization, allowing it to execute in a user’s browser when the preference is accessed. This can lead to session hijacking, credential theft, or other malicious actions performed in the context of the victim’s browser.

This flaw affects Znuny LTS releases prior to 6.5.21 and Znuny core releases prior to 7.3.3. Users running these versions should verify that their deployment does not include the vulnerable preferences handling code.

The CVSS score of 5.4 indicates moderate severity. No EPSS value is available and the flaw is not listed in CISA KEV, suggesting limited public exploitation. Likely attack requires an attacker to alter a user’s preference entry, which may demand legitimate account access or a user action that accepts input. Once the malicious payload is stored, any user loading that preference will be affected; the absence of a public exploit reduces immediate risk, but mitigation remains prudent.