A weakness in the editPage function of LinkStackOrg LinkStack allows an attacker to inject malicious script via the pageDescription parameter. The flaw is a classic stored cross‑site scripting issue, so injected payloads will persist in the database and execute in any user’s browser that views the affected page. This can permit theft of session cookies, defacement or distribution of malware to site users and can compromise confidentiality, integrity and availability of the application data.

LinkStackOrg LinkStack versions up to and including 4.8.6 are affected. The vulnerability resides in the file app/Http/Controllers/UserController.php of the project hosted on GitHub. No other products are listed as impacted.

The CVSS base score is 5.1, indicating moderate risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the public availability of an exploit code suggests it is actively exploitable. Attackers can launch the attack remotely by sending crafted requests containing malicious pageDescription data; no special privileges or local access are required.