A stored cross‑site scripting vulnerability exists in the announcement preview component of REBUILD 4.4.3. The server properly escapes announcement content, but the client‑side preview logic reverses the escaped entities with jQuery’s html().text() and then injects the result into the DOM. Because the announcement content can be set by an administrator or attacker with control over announcements, arbitrary JavaScript can be executed in any user’s browser when the preview or the final announcement page is rendered. This enables code execution in the context of the visitor, potentially allowing theft of session cookies, credential hijacking, or other malicious actions.

The affected product is REBUILD 4.4.3. No other affected versions are listed in the current data.

The vulnerability can be exploited by entities that can create or edit announcements, which typically requires privileged or administrative access. The CVSS score of 5.4 indicates moderate severity. While the EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, the presence of stored XSS and the broad visibility of announcement pages (dashboard, activity feed, login page) mean that once exploited it can compromise all users who view the affected content. It is not mentioned in the data that public exploits exist; the current information does not confirm whether any are known, so the risk assessment remains based on potential for internal or targeted exploitation.