Dayforce ESS Excelity contains multiple reflected cross‑site scripting flaws in several endpoints. An attacker can craft a URL that, when a victim opens it, injects arbitrary JavaScript into the victim’s browser. The script runs with the user’s privileges, allowing client‑side code execution. The description does not specify additional consequences; any exploitation results in arbitrary code execution in the browser context.

The affected product is Dayforce ESS Excelity, as identified by the CNA. The report notes that a fix was implemented in version V4, but no other specific earlier or later version numbers are provided. Any installation of Dayforce ESS Excelity that has not applied the V4 update may still be vulnerable.

The CVSS score of 5.1 indicates moderate severity. The EPSS score is reported as less than 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is client‑side; an attacker must convince a user to visit a crafted link and does not require additional privileges or network access. While indirect, the ability to run arbitrary JavaScript in a user’s browser poses a moderate risk.