A stored cross‑site scripting vulnerability exists in the announcement preview component of REBUILD 4.4.3. The server properly escapes announcement content, but the client‑side preview logic reverses the escaped entities with jQuery's html().text() and then injects the result into the DOM. Because the announcement content can be set by an administrator or attacker with control over announcements, arbitrary JavaScript can be executed in any user’s browser when the preview or the final announcement page is rendered. This enables code execution in the context of the visitor, potentially allowing theft of session cookies, credential hijacking, or other malicious actions.

The affected product is REBUILD 4.4.3. No other affected versions are listed in the current data.

The vulnerability can be exploited by entities that can create or edit announcements, which typically requires privileged or administrative access. While the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the presence of stored XSS and the broad visibility of announcement pages (dashboard, activity feed, login page) mean that once exploited it can compromise all users who view the affected content. The lack of publicly known exploits does not mitigate the risk of an internal or targeted attack exploiting the flaw.