Omnispace Agora Project versions before 26.10.0 contain a stored cross‑site scripting flaw. An authenticated attacker can submit a two‑dimensional array of values through the LDAP/person import flow, and the paramsFilter() request filter fails to recurse into nested arrays. The malicious payload is stored in a user profile and later rendered unescaped, causing arbitrary JavaScript execution in other users' browsers.

The vulnerability affects the Omnispace Agora Project when running any release prior to version 26.10.0. The affected component is the LDAP/person import mechanism that accepts POST array input. All deployments of this product that have not upgraded beyond 26.10.0 are susceptible, regardless of other configuration.

With a CVSS score of 5.1, the flaw is considered moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Because it requires authentication, an attacker must first obtain access to a user account with import privileges. Once authenticated, exploitation is straightforward: the attacker submits crafted nested POST data, the malicious payload is stored, and when other users view pages that render the profile, their browsers execute the injected script.