The vulnerability is an input neutralization flaw in the Webhook URL form field of Crafty Controller that permits a remote, authenticated attacker to store malicious script. This flaw is a classic stored XSS issue identified as CWE‑79, enabling the attacker to execute arbitrary JavaScript on the browsers of any user who views the affected page, potentially allowing session hijacking, data theft, or defacement.

The issue affects Arcadia Technology’s Crafty Controller product. All releases prior to version 4.11.0 are vulnerable, as the official fix is to upgrade to that version or later.

The CVSS score of 5.4 places the flaw in the medium severity range. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the Webhook URL form, after which the malicious payload is stored and will run in the browsers of any user that visits the modified page. Because the attack vector is authenticated, a threat requires compromised credentials or permission to access the form; however, once stored, the impact applies to all users who view the page, so the risk remains moderate.