The flaw is a stored cross‑site scripting vulnerability that enables an authenticated user to inject malicious JavaScript by entering a category description containing a double‑quote character. The double quote closes the value attribute of an HTML input, then the script executes when any user views the forum category. The resulting script can hijack the victim’s session, steal credentials, or perform other client‑side attacks.

The vulnerability exists in Omnispace Agora Project versions prior to 26.10.0. No other products or vendors are affected.

The vulnerability scores 5.1 on the CVSS scale, indicating a medium severity. The EPSS score of less than 1 % suggests that exploitation is unlikely at present, and the flaw is not listed in the CISA KEV catalog. An attacker must first authenticate to create or edit a category; after doing so, the malicious payload is persisted and will execute in the browsers of all users who view that category. Because the attack vector requires user privileges and an online forum, the risk is limited to authenticated users with category creation rights.