MCO is vulnerable to Stored Cross‑Site Scripting (XSS) through its logo upload feature. An attacker who can change the application logo can upload a crafted SVG file that includes malicious JavaScript, which is executed when the image is rendered or opened, potentially stealing session cookies or performing actions on behalf of the user. This flaw is a classic example of CWE-79 where arbitrary code is stored and later executed in the victim's browser.

The vulnerability has been confirmed in MyComplianceOffice version 25.3.3.1. Because vendor contact attempts failed, the affected product is limited to that version, though the flaw may exist in other releases as well.

The CVSS score of 4.8 indicates moderate risk, and the EPSS score is not available, suggesting low or unquantified exploitation likelihood. The flaw is not listed in CISA’s KEV catalog. Exploitation requires the attacker to have the ability to upload an SVG as an application logo, implying that only users with administrative or configuration privileges can achieve it. Successfully delivering malicious code would lead to browser‑level code execution but not system‑level compromise.