The vulnerability arises in Etherpad’s HTML export feature, where custom plugin data inserted into the export is not properly escaped. By placing malicious input via the AttributePool before the export, an attacker can place attacker‑controlled values into the attribute pool through moveOpsToNewPool and AttributePool.putAttrib. When the resulting HTML is opened in a browser, the unescaped data becomes executable script, causing stored cross‑site scripting within the Etherpad domain. The issue is a typical input validation weakness categorized as CWE‑79. The offending code path relies on the getHTMLFromAtext routine and the exportHtmlAdditionalTagsWithData hook, which are invoked by plugins such as ep_font_color or ep_font_size.

Prior to version 3.3.0 of Etherpad, any deployment that enables the exportHtmlAdditionalTagsWithData hook from a plugin can be affected. This includes instances that have the ep_font_color or ep_font_size plugins installed, or any other plugin that registers the same hook. The vulnerability is fixed starting with release v3.3.0; earlier releases are vulnerable regardless of other configuration settings. The CWE reference is CWE‑79.

The reported CVSS score of 5.3 indicates moderate overall impact, with the exploitation possible when an attacker has control over the attribute data for a pad. The EPSS score is not available, so the exact likelihood cannot be quantified, but the KEV catalogue does not list this vulnerability, suggesting that no widespread exploitation has been reported. The attack is primarily limited to browsers rendering the exported HTML; attackers would need to get a victim to open the compromised file. Consequently, the risk is moderate for environments that expose exported files directly to users.